<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link href="common/css/sf.css" rel="stylesheet" type="text/css" />
<title>Hoare2: Hoare Logic, Part II</title>
<link href="common/jquery-ui/jquery-ui.css" rel="stylesheet">
<script src="common/jquery-ui/external/jquery/jquery.js"></script>
<script src="common/jquery-ui/jquery-ui.js"></script>
<script src="common/toggleproofs.js"></script>
<link href="common/css/plf.css" rel="stylesheet" type="text/css"/>
</head>

<body>

<div id="page">

<div id="header">
<div id='logoinheader'><a href='https://softwarefoundations.cis.upenn.edu'>
<img src='common/media/image/sf_logo_sm.png' alt='Software Foundations Logo'></a></div>
<div class='booktitleinheader'><a href='index.html'>Volume 2: Programming Language Foundations</a></div>
<ul id='menu'>
   <li class='section_name'><a href='toc.html'>Table of Contents</a></li>
   <li class='section_name'><a href='coqindex.html'>Index</a></li>
   <li class='section_name'><a href='deps.html'>Roadmap</a></li>
</ul>
</div>

<div id="main">

<h1 class="libtitle">Hoare2<span class="subtitle">Hoare Logic, Part II</span></h1>


<div class="code">

<span class="id" title="keyword">Set</span> <span class="id" title="var">Warnings</span> "-notation-overridden,-parsing,-deprecated-hint-without-locality".<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#"><span class="id" title="library">Strings.String</span></a>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">PLF</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <span class="id" title="library">Maps</span>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Bool.Bool.html#"><span class="id" title="library">Bool.Bool</span></a>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Arith.html#"><span class="id" title="library">Arith.Arith</span></a>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.EqNat.html#"><span class="id" title="library">Arith.EqNat</span></a>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#"><span class="id" title="library">Arith.PeanoNat</span></a>. <span class="id" title="keyword">Import</span> <span class="id" title="var">Nat</span>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.micromega.Lia.html#"><span class="id" title="library">Lia</span></a>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">PLF</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Export</span> <span class="id" title="library">Imp</span>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">PLF</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="Hoare.html#"><span class="id" title="library">Hoare</span></a>.<br/>
</div>

<div class="doc">
<a id="lab93"></a><h1 class="section">Decorated Programs</h1>

<div class="paragraph"> </div>

 The beauty of Hoare Logic is that it is <i>compositional</i>: the
    structure of proofs exactly follows the structure of programs.

<div class="paragraph"> </div>

    As we saw in <a href="Hoare.html"><span class="inlineref">Hoare</span></a>, we can record the essential ideas of a
    proof (informally, and leaving out some low-level calculational
    details) by "decorating" a program with appropriate assertions on
    each of its commands.

<div class="paragraph"> </div>

    Such a <i>decorated program</i> carries within it an argument for its
    own correctness. 
<div class="paragraph"> </div>

 For example, consider the program:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">m</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">p</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span>
</span> Here is one possible specification for this program:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">m</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">p</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">p</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>   Note the <i>parameters</i> <span class="inlinecode"><span class="id" title="var">m</span></span> and <span class="inlinecode"><span class="id" title="var">p</span></span>, which stand for
   fixed-but-arbitrary numbers.  Formally, they are simply Coq
   variables of type <span class="inlinecode"><span class="id" title="var">nat</span></span>.
 Here is a decorated version of the program, embodying a
    proof of this specification:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">m</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">m</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">p</span> = <span class="id" title="var">p</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">p</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Z</span> = <span class="id" title="var">p</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> - <span class="id" title="var">X</span> = <span class="id" title="var">p</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> - <span class="id" title="var">X</span> = <span class="id" title="var">p</span> - <span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> ≠ 0 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ (<span class="id" title="var">Z</span> - 1) - (<span class="id" title="var">X</span> - 1) = <span class="id" title="var">p</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> - (<span class="id" title="var">X</span> - 1) = <span class="id" title="var">p</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> - <span class="id" title="var">X</span> = <span class="id" title="var">p</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> - <span class="id" title="var">X</span> = <span class="id" title="var">p</span> - <span class="id" title="var">m</span> ∧ ¬(<span class="id" title="var">X</span> ≠ 0) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">p</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

 Concretely, a decorated program consists of the program text
    interleaved with assertions (or possibly multiple assertions
    separated by implications). 
<div class="paragraph"> </div>

 To check that a decorated program represents a valid proof, we
    check that each individual command is <i>locally consistent</i> with
    its nearby assertions in the following sense: 
<div class="paragraph"> </div>

<ul class="doclist">
<li> <span class="inlinecode"><span class="id" title="var">skip</span></span> is locally consistent if its precondition and
      postcondition are the same:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">skip</span> <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
</li>
</ul>

<div class="paragraph"> </div>

<ul class="doclist">
<li> The sequential composition of <span class="inlinecode"><span class="id" title="var">c<sub>1</sub></span></span> and <span class="inlinecode"><span class="id" title="var">c<sub>2</sub></span></span> is locally
      consistent (with respect to assertions <span class="inlinecode"><span class="id" title="var">P</span></span> and <span class="inlinecode"><span class="id" title="var">R</span></span>) if <span class="inlinecode"><span class="id" title="var">c<sub>1</sub></span></span> is
      locally consistent (with respect to <span class="inlinecode"><span class="id" title="var">P</span></span> and <span class="inlinecode"><span class="id" title="var">Q</span></span>) and <span class="inlinecode"><span class="id" title="var">c<sub>2</sub></span></span> is
      locally consistent (with respect to <span class="inlinecode"><span class="id" title="var">Q</span></span> and <span class="inlinecode"><span class="id" title="var">R</span></span>):
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c<sub>1</sub></span>; <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Q</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c<sub>2</sub></span> <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">R</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
</li>
</ul>

<div class="paragraph"> </div>

<ul class="doclist">
<li> An assignment <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">a</span></span> is locally consistent with respect to
      a precondition of the form <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode">[<span class="id" title="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> <span class="inlinecode"><span class="id" title="var">a</span>]</span> and the postcondition <span class="inlinecode"><span class="id" title="var">P</span></span>:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> [<span class="id" title="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" title="var">a</span>] <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">a</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
</li>
</ul>

<div class="paragraph"> </div>

<ul class="doclist">
<li> A conditional is locally consistent with respect to assertions
      <span class="inlinecode"><span class="id" title="var">P</span></span> and <span class="inlinecode"><span class="id" title="var">Q</span></span> if its "then" branch is locally consistent with respect
      to <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">b</span></span> and <span class="inlinecode"><span class="id" title="var">Q</span></span>) and its "else" branch is locally consistent
      with respect to <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode">¬<span class="id" title="var">b</span></span> and <span class="inlinecode"><span class="id" title="var">Q</span></span>:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">if</span> <span class="id" title="var">b</span> <span class="id" title="keyword">then</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> ∧ <span class="id" title="var">b</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">c<sub>1</sub></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Q</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">else</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> ∧ ¬<span class="id" title="var">b</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">c<sub>2</sub></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Q</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Q</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
</li>
</ul>

<div class="paragraph"> </div>

<ul class="doclist">
<li> A while loop with precondition <span class="inlinecode"><span class="id" title="var">P</span></span> is locally consistent if its
      postcondition is <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode">¬<span class="id" title="var">b</span></span>, if the pre- and postconditions of
      its body are exactly <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">b</span></span> and <span class="inlinecode"><span class="id" title="var">P</span></span>, and if its body is
      locally consistent with respect to assertions <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">b</span></span> and <span class="inlinecode"><span class="id" title="var">P</span></span>:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> <span class="id" title="var">b</span> <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> ∧ <span class="id" title="var">b</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">c<sub>1</sub></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> ∧ ¬<span class="id" title="var">b</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
</li>
</ul>

<div class="paragraph"> </div>

<ul class="doclist">
<li> A pair of assertions separated by <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> is locally consistent if
      the first implies the second:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P'</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>      This corresponds to the application of <span class="inlinecode"><span class="id" title="var">hoare_consequence</span></span>, and it
      is the <i>only</i> place in a decorated program where checking whether
      decorations are correct is not fully mechanical and syntactic,
      but rather may involve logical and/or arithmetic reasoning. 
</li>
</ul>

<div class="paragraph"> </div>

 These local consistency conditions essentially describe a
    procedure for <i>verifying</i> the correctness of a given proof. This
    verification involves checking that every single command is
    locally consistent with the accompanying assertions.

<div class="paragraph"> </div>

    If we are instead interested in <i>finding</i> a proof for a given
    specification, we need to discover the right assertions. This can
    be done in an almost mechanical way, with the exception of finding
    loop invariants. In the remainder of this section we explain in
    detail how to construct decorations for several short programs,
    all of which are loop-free or have simple loop invariants. We
    defer a full discussion of finding loop invariants to the next
    section. 
</div>

<div class="doc">
<a id="lab94"></a><h2 class="section">Example: Swapping Using Addition and Subtraction</h2>

<div class="paragraph"> </div>

 Here is a program that swaps the values of two variables using
    addition and subtraction (instead of by assigning to a temporary
    variable).
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> + <span class="id" title="var">Y</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">X</span> - <span class="id" title="var">Y</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - <span class="id" title="var">Y</span>
</span>    We can prove (informally) using decorations that this program is
    correct -- i.e., it always swaps the values of variables <span class="inlinecode"><span class="id" title="var">X</span></span> and <span class="inlinecode"><span class="id" title="var">Y</span></span>. 
<div class="paragraph"> </div>

<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;(1)     <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(2)     <span style='letter-spacing:-.4em;'>{</span>{ (<span class="id" title="var">X</span> + <span class="id" title="var">Y</span>) - ((<span class="id" title="var">X</span> + <span class="id" title="var">Y</span>) - <span class="id" title="var">Y</span>) = <span class="id" title="var">n</span> ∧ (<span class="id" title="var">X</span> + <span class="id" title="var">Y</span>) - <span class="id" title="var">Y</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> + <span class="id" title="var">Y</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(3)     <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> - (<span class="id" title="var">X</span> - <span class="id" title="var">Y</span>) = <span class="id" title="var">n</span> ∧ <span class="id" title="var">X</span> - <span class="id" title="var">Y</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">X</span> - <span class="id" title="var">Y</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(4)     <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> - <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> ∧ <span class="id" title="var">Y</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - <span class="id" title="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(5)     <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">n</span> ∧ <span class="id" title="var">Y</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    The decorations can be constructed as follows:

<div class="paragraph"> </div>

<ul class="doclist">
<li> We begin with the undecorated program (the unnumbered lines).

<div class="paragraph"> </div>


</li>
<li> We add the specification -- i.e., the outer precondition (1)
        and postcondition (5). In the precondition, we use parameters
        <span class="inlinecode"><span class="id" title="var">m</span></span> and <span class="inlinecode"><span class="id" title="var">n</span></span> to remember the initial values of variables <span class="inlinecode"><span class="id" title="var">X</span></span>
        and <span class="inlinecode"><span class="id" title="var">Y</span></span> so that we can refer to them in the postcondition (5).

<div class="paragraph"> </div>


</li>
<li> We work backwards, mechanically, starting from (5) and
        proceeding until we get to (2). At each step, we obtain the
        precondition of the assignment from its postcondition by
        substituting the assigned variable with the right-hand-side of
        the assignment. For instance, we obtain (4) by substituting
        <span class="inlinecode"><span class="id" title="var">X</span></span> with <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> in (5), and we obtain (3) by substituting <span class="inlinecode"><span class="id" title="var">Y</span></span>
        with <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> in (4).

</li>
</ul>

<div class="paragraph"> </div>

    Finally, we verify that (1) logically implies (2) -- i.e., that
    the step from (1) to (2) is a valid use of the law of
    consequence. For this we substitute <span class="inlinecode"><span class="id" title="var">X</span></span> by <span class="inlinecode"><span class="id" title="var">m</span></span> and <span class="inlinecode"><span class="id" title="var">Y</span></span> by <span class="inlinecode"><span class="id" title="var">n</span></span> and
    calculate as follows:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="var">m</span> + <span class="id" title="var">n</span>) - ((<span class="id" title="var">m</span> + <span class="id" title="var">n</span>) - <span class="id" title="var">n</span>) = <span class="id" title="var">n</span> ∧ (<span class="id" title="var">m</span> + <span class="id" title="var">n</span>) - <span class="id" title="var">n</span> = <span class="id" title="var">m</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="var">m</span> + <span class="id" title="var">n</span>) - <span class="id" title="var">m</span> = <span class="id" title="var">n</span> ∧ <span class="id" title="var">m</span> = <span class="id" title="var">m</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">n</span> = <span class="id" title="var">n</span> ∧ <span class="id" title="var">m</span> = <span class="id" title="var">m</span>
</span>
<div class="paragraph"> </div>

    Note that, since we are working with natural numbers rather than
    fixed-width machine integers, we don't need to worry about the
    possibility of arithmetic overflow anywhere in this argument.
    This makes life quite a bit simpler! 
</div>

<div class="doc">
<a id="lab95"></a><h2 class="section">Example: Simple Conditionals</h2>

<div class="paragraph"> </div>

 Here is a simple decorated program using conditionals:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(1)     <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">if</span> <span class="id" title="var">X</span> ≤ <span class="id" title="var">Y</span> <span class="id" title="keyword">then</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(2)       <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span> ∧ <span class="id" title="var">X</span> ≤ <span class="id" title="var">Y</span><span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(3)       <span style='letter-spacing:-.4em;'>{</span>{(<span class="id" title="var">Y</span> - <span class="id" title="var">X</span>) + <span class="id" title="var">X</span> = <span class="id" title="var">Y</span> ∨ (<span class="id" title="var">Y</span> - <span class="id" title="var">X</span>) + <span class="id" title="var">Y</span> = <span class="id" title="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Y</span> - <span class="id" title="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(4)       <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Z</span> + <span class="id" title="var">X</span> = <span class="id" title="var">Y</span> ∨ <span class="id" title="var">Z</span> + <span class="id" title="var">Y</span> = <span class="id" title="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">else</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(5)       <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span> ∧ ~(<span class="id" title="var">X</span> ≤ <span class="id" title="var">Y</span>) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(6)       <span style='letter-spacing:-.4em;'>{</span>{(<span class="id" title="var">X</span> - <span class="id" title="var">Y</span>) + <span class="id" title="var">X</span> = <span class="id" title="var">Y</span> ∨ (<span class="id" title="var">X</span> - <span class="id" title="var">Y</span>) + <span class="id" title="var">Y</span> = <span class="id" title="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">X</span> - <span class="id" title="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(7)       <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Z</span> + <span class="id" title="var">X</span> = <span class="id" title="var">Y</span> ∨ <span class="id" title="var">Z</span> + <span class="id" title="var">Y</span> = <span class="id" title="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(8)     <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Z</span> + <span class="id" title="var">X</span> = <span class="id" title="var">Y</span> ∨ <span class="id" title="var">Z</span> + <span class="id" title="var">Y</span> = <span class="id" title="var">X</span><span style='letter-spacing:-.4em;'>}</span>}
</span>These decorations were constructed as follows:

<div class="paragraph"> </div>

<ul class="doclist">
<li> We start with the outer precondition (1) and postcondition (8).

<div class="paragraph"> </div>


</li>
<li> We follow the format dictated by the <span class="inlinecode"><span class="id" title="var">hoare_if</span></span> rule and copy the
    postcondition (8) to (4) and (7). We conjoin the precondition (1)
    with the guard of the conditional to obtain (2). We conjoin (1)
    with the negated guard of the conditional to obtain (5).

<div class="paragraph"> </div>


</li>
<li> In order to use the assignment rule and obtain (3), we substitute
    <span class="inlinecode"><span class="id" title="var">Z</span></span> by <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">X</span></span> in (4). To obtain (6) we substitute <span class="inlinecode"><span class="id" title="var">Z</span></span> by <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">Y</span></span>
    in (7).

</li>
<li> Finally, we verify that (2) implies (3) and (5) implies (6). Both
    of these implications crucially depend on the ordering of <span class="inlinecode"><span class="id" title="var">X</span></span> and
    <span class="inlinecode"><span class="id" title="var">Y</span></span> obtained from the guard. For instance, knowing that <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode"><span class="id" title="var">Y</span></span>
    ensures that subtracting <span class="inlinecode"><span class="id" title="var">X</span></span> from <span class="inlinecode"><span class="id" title="var">Y</span></span> and then adding back <span class="inlinecode"><span class="id" title="var">X</span></span>
    produces <span class="inlinecode"><span class="id" title="var">Y</span></span>, as required by the first disjunct of (3). Similarly,
    knowing that <span class="inlinecode">¬</span> <span class="inlinecode">(<span class="id" title="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode"><span class="id" title="var">Y</span>)</span> ensures that subtracting <span class="inlinecode"><span class="id" title="var">Y</span></span> from <span class="inlinecode"><span class="id" title="var">X</span></span>
    and then adding back <span class="inlinecode"><span class="id" title="var">Y</span></span> produces <span class="inlinecode"><span class="id" title="var">X</span></span>, as needed by the second
    disjunct of (6). Note that <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span> does <i>not</i> hold for
    arbitrary natural numbers <span class="inlinecode"><span class="id" title="var">n</span></span> and <span class="inlinecode"><span class="id" title="var">m</span></span> (for example, <span class="inlinecode">3</span> <span class="inlinecode">-</span> <span class="inlinecode">5</span> <span class="inlinecode">+</span> <span class="inlinecode">5</span> <span class="inlinecode">=</span>
    <span class="inlinecode">5</span>). 
</li>
</ul>

<div class="paragraph"> </div>

<a id="lab96"></a><h4 class="section">Exercise: 2 stars, standard (if_minus_plus_reloaded)</h4>
 Fill in valid decorations for the following program:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">if</span> <span class="id" title="var">X</span> ≤ <span class="id" title="var">Y</span> <span class="id" title="keyword">then</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                         <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                         <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Y</span> - <span class="id" title="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                         <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">else</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                         <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                         <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">X</span> + <span class="id" title="var">Z</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                         <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">X</span> + <span class="id" title="var">Z</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    Briefly justify each use of <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>.

</div>
<div class="code">

<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" title="keyword">Definition</span> <a id="manual_grade_for_decorations_in_if_minus_plus_reloaded" class="idref" href="#manual_grade_for_decorations_in_if_minus_plus_reloaded"><span class="id" title="definition">manual_grade_for_decorations_in_if_minus_plus_reloaded</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#option"><span class="id" title="inductive">option</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#11c698c8685bb8ab1cf725545c085ac<sub>4</sub>"><span class="id" title="notation">×</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#None"><span class="id" title="constructor">None</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab97"></a><h2 class="section">Example: Reduce to Zero</h2>

<div class="paragraph"> </div>

 Here is a <span class="inlinecode"><span class="id" title="var">while</span></span> loop that is so simple that <span class="inlinecode"><span class="id" title="var">True</span></span> suffices
    as a loop invariant.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(1)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(2)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> ∧ <span class="id" title="var">X</span> ≠ 0 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(3)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(4)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(5)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> ∧ ~(<span class="id" title="var">X</span> ≠ 0) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(6)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 0 <span style='letter-spacing:-.4em;'>}</span>}
</span>   The decorations can be constructed as follows:

<div class="paragraph"> </div>

<ul class="doclist">
<li> Start with the outer precondition (1) and postcondition (6).

<div class="paragraph"> </div>


</li>
<li> Following the format dictated by the <span class="inlinecode"><span class="id" title="var">hoare_while</span></span> rule, we copy
       (1) to (4). We conjoin (1) with the guard to obtain (2). The guard
       is a Boolean expression <span class="inlinecode">~(<span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0)</span>, which for simplicity we
       express in assertion (2) as <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">≠</span> <span class="inlinecode">0</span>. We also conjoin (1) with the
       negation of the guard to obtain (5).

<div class="paragraph"> </div>


</li>
<li> Because the outer postcondition (6) does not syntactically match (5),
       we add an implication between them.

<div class="paragraph"> </div>


</li>
<li> Using the assignment rule with assertion (4), we trivially substitute
       and obtain assertion (3).

<div class="paragraph"> </div>


</li>
<li> We add the implication between (2) and (3).

</li>
</ul>

<div class="paragraph"> </div>

   Finally we check that the implications do hold; both are trivial. 
<div class="paragraph"> </div>

 From an informal proof in the form of a decorated program, it is
    easy to read off a formal proof using the Coq theorems
    corresponding to the Hoare Logic rules.  Note that we do <i>not</i>
    unfold the definition of <span class="inlinecode"><span class="id" title="var">hoare_triple</span></span> anywhere in this proof:
    the point of the game is to use the Hoare rules as a
    self-contained logic for reasoning about programs. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="reduce_to_zero'" class="idref" href="#reduce_to_zero'"><span class="id" title="definition">reduce_to_zero'</span></a> : <span class="id" title="inductive">com</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span> <span class="id" title="notation">while</span> <span class="id" title="notation">¬</span><span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 0<span class="id" title="notation">)</span> <span class="id" title="notation">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="notation">end</span> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="reduce_to_zero_correct'" class="idref" href="#reduce_to_zero_correct'"><span class="id" title="lemma">reduce_to_zero_correct'</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#reduce_to_zero'"><span class="id" title="definition">reduce_to_zero'</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare2.html#reduce_to_zero'"><span class="id" title="definition">reduce_to_zero'</span></a>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;First&nbsp;we&nbsp;need&nbsp;to&nbsp;transform&nbsp;the&nbsp;postcondition&nbsp;so<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;that&nbsp;hoare_while&nbsp;will&nbsp;apply.&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_post"><span class="id" title="lemma">hoare_consequence_post</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_while"><span class="id" title="lemma">hoare_while</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;Loop&nbsp;body&nbsp;preserves&nbsp;invariant&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;Need&nbsp;to&nbsp;massage&nbsp;precondition&nbsp;before&nbsp;<span class="inlinecode"><span class="id" title="var">hoare_asgn</span></span>&nbsp;applies&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;× <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;× <span class="comment">(*&nbsp;Proving&nbsp;trivial&nbsp;implication&nbsp;(2)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;(3)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a>, "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>". <span class="id" title="tactic">simpl</span>. <span class="id" title="tactic">intros</span>. <span class="id" title="tactic">exact</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#I"><span class="id" title="constructor">I</span></a>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Invariant&nbsp;and&nbsp;negated&nbsp;guard&nbsp;imply&nbsp;postcondition&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">st</span> [<span class="id" title="var">Inv</span> <span class="id" title="var">GuardFalse</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">bassn</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">GuardFalse</span>. <span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> <span class="id" title="var">GuardFalse</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Bool.Bool.html#not_true_iff_false"><span class="id" title="lemma">not_true_iff_false</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">GuardFalse</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Bool.Bool.html#negb_false_iff"><span class="id" title="lemma">negb_false_iff</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">GuardFalse</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.eqb_eq"><span class="id" title="lemma">eqb_eq</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">GuardFalse</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">GuardFalse</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
In <a href="Hoare.html"><span class="inlineref">Hoare</span></a> we introduced a series of tactics named <span class="inlinecode"><span class="id" title="var">assn_auto</span></span>
    to automate proofs involving just assertions.  We can try using
    the most advanced of those tactics to streamline the previous proof: 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="reduce_to_zero_correct''" class="idref" href="#reduce_to_zero_correct''"><span class="id" title="lemma">reduce_to_zero_correct''</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#reduce_to_zero'"><span class="id" title="definition">reduce_to_zero'</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare2.html#reduce_to_zero'"><span class="id" title="definition">reduce_to_zero'</span></a>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_post"><span class="id" title="lemma">hoare_consequence_post</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_while"><span class="id" title="lemma">hoare_while</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;× <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;× <span class="id" title="var">assn_auto''</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="var">assn_auto''</span>. <span class="comment">(*&nbsp;doesn't&nbsp;succeed&nbsp;*)</span><br/>
<span class="id" title="keyword">Abort</span>.<br/>
</div>

<div class="doc">
Let's introduce a (much) more sophisticated tactic that will
    help with proving assertions throughout the rest of this chapter.
    You don't need to understand the details of it. Briefly, it uses
    <span class="inlinecode"><span class="id" title="tactic">split</span></span> repeatedly to turn all the conjunctions into separate
    subgoals, tries to use several theorems about booleans
    and (in)equalities, then uses <span class="inlinecode"><span class="id" title="tactic">eauto</span></span> and <span class="inlinecode"><span class="id" title="var">lia</span></span> to finish off as
    many subgoals as possible. What's left after <span class="inlinecode"><span class="id" title="var">verify</span></span> does its
    thing is just the "interesting parts" of checking that the
    assertions correct --which might be nothing. 
</div>
<div class="code">

<span class="id" title="keyword">Ltac</span> <span class="id" title="var">verify_assn</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="tactic">split</span>;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">simpl</span>; <span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#assert_implies"><span class="id" title="definition">assert_implies</span></a>;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <span class="id" title="keyword">in</span> *; <span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#ap<sub>2</sub>"><span class="id" title="definition">ap<sub>2</sub></span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">bassn</span></a> <span class="id" title="keyword">in</span> *; <span class="id" title="tactic">unfold</span> <span class="id" title="definition">beval</span> <span class="id" title="keyword">in</span> *; <span class="id" title="tactic">unfold</span> <span class="id" title="definition">aeval</span> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a>; <span class="id" title="tactic">intros</span>;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> (<span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <span class="id" title="axiom">t_update_eq</span> ||<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="tactic">try</span> <span class="id" title="tactic">rewrite</span> <span class="id" title="axiom">t_update_neq</span>; [| (<span class="id" title="tactic">intro</span> <span class="id" title="var">X</span>; <span class="id" title="tactic">inversion</span> <span class="id" title="var">X</span>; <span class="id" title="tactic">fail</span>)]));<br/>
&nbsp;&nbsp;<span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="keyword">match</span> <span class="id" title="keyword">goal</span> <span class="id" title="keyword">with</span> [<span class="id" title="var">H</span> : <span class="id" title="var">_</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <span class="id" title="var">_</span> &#x22A2; <span class="id" title="var">_</span>] ⇒ <span class="id" title="tactic">destruct</span> <span class="id" title="var">H</span> <span class="id" title="keyword">end</span>;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Bool.Bool.html#not_true_iff_false"><span class="id" title="lemma">not_true_iff_false</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Bool.Bool.html#not_false_iff_true"><span class="id" title="lemma">not_false_iff_true</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Bool.Bool.html#negb_true_iff"><span class="id" title="lemma">negb_true_iff</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Bool.Bool.html#negb_false_iff"><span class="id" title="lemma">negb_false_iff</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.eqb_eq"><span class="id" title="lemma">eqb_eq</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.eqb_neq"><span class="id" title="lemma">eqb_neq</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Compare_dec.html#leb_iff"><span class="id" title="abbreviation">leb_iff</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Compare_dec.html#leb_iff_conv"><span class="id" title="lemma">leb_iff_conv</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">subst</span>;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">match</span> <span class="id" title="keyword">goal</span> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[<span class="id" title="var">st</span> : <span class="id" title="definition">state</span> &#x22A2; <span class="id" title="var">_</span>] ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">match</span> <span class="id" title="keyword">goal</span> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| [<span class="id" title="var">H</span> : <span class="id" title="var">st</span> <span class="id" title="var">_</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="var">_</span> &#x22A2; <span class="id" title="var">_</span>] ⇒ <span class="id" title="tactic">rewrite</span> → <span class="id" title="var">H</span> <span class="id" title="keyword">in</span> *; <span class="id" title="tactic">clear</span> <span class="id" title="var">H</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| [<span class="id" title="var">H</span> : <span class="id" title="var">_</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="var">st</span> <span class="id" title="var">_</span> &#x22A2; <span class="id" title="var">_</span>] ⇒ <span class="id" title="tactic">rewrite</span> &lt;- <span class="id" title="var">H</span> <span class="id" title="keyword">in</span> *; <span class="id" title="tactic">clear</span> <span class="id" title="var">H</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span>;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">eauto</span>; <span class="id" title="tactic">try</span> <span class="id" title="var">lia</span>.<br/>
</div>

<div class="doc">
All that automation makes it easy to verify <span class="inlinecode"><span class="id" title="var">reduce_to_zero'</span></span>: 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="reduce_to_zero_correct'''" class="idref" href="#reduce_to_zero_correct'''"><span class="id" title="lemma">reduce_to_zero_correct'''</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#reduce_to_zero'"><span class="id" title="definition">reduce_to_zero'</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol1" onclick="toggleDisplay('proof1');toggleDisplay('proofcontrol1')"><span class="show"></span></div>
<div class="proofscript" id="proof1" onclick="toggleDisplay('proof1');toggleDisplay('proofcontrol1')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare2.html#reduce_to_zero'"><span class="id" title="definition">reduce_to_zero'</span></a>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_post"><span class="id" title="lemma">hoare_consequence_post</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_while"><span class="id" title="lemma">hoare_while</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;× <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;× <span class="id" title="var">verify_assn</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="var">verify_assn</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a id="lab98"></a><h2 class="section">Example: Division</h2>

<div class="paragraph"> </div>

 The following Imp program calculates the integer quotient and
    remainder of parameters <span class="inlinecode"><span class="id" title="var">m</span></span> and <span class="inlinecode"><span class="id" title="var">n</span></span>.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">m</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> <span class="id" title="var">n</span> ≤ <span class="id" title="var">X</span> <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - <span class="id" title="var">n</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span>;
</span>    If we replace <span class="inlinecode"><span class="id" title="var">m</span></span> and <span class="inlinecode"><span class="id" title="var">n</span></span> by numbers and execute the program, it
    will terminate with the variable <span class="inlinecode"><span class="id" title="var">X</span></span> set to the remainder when <span class="inlinecode"><span class="id" title="var">m</span></span>
    is divided by <span class="inlinecode"><span class="id" title="var">n</span></span> and <span class="inlinecode"><span class="id" title="var">Y</span></span> set to the quotient. 
<div class="paragraph"> </div>

 In order to give a specification to this program we need to
    remember that dividing <span class="inlinecode"><span class="id" title="var">m</span></span> by <span class="inlinecode"><span class="id" title="var">n</span></span> produces a remainder <span class="inlinecode"><span class="id" title="var">X</span></span> and a
    quotient <span class="inlinecode"><span class="id" title="var">Y</span></span> such that <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">×</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">&lt;</span> <span class="inlinecode"><span class="id" title="var">n</span></span>.

<div class="paragraph"> </div>

    It turns out that we get lucky with this program and don't have to
    think very hard about the loop invariant: the invariant is just
    the first conjunct <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">×</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span>, and we can use this to
    decorate the program.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(1)    <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(2)    <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">n</span> × 0 + <span class="id" title="var">m</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">m</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(3)    <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">n</span> × 0 + <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(4)    <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">n</span> × <span class="id" title="var">Y</span> + <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> <span class="id" title="var">n</span> ≤ <span class="id" title="var">X</span> <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(5)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">n</span> × <span class="id" title="var">Y</span> + <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">n</span> ≤ <span class="id" title="var">X</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(6)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">n</span> × (<span class="id" title="var">Y</span> + 1) + (<span class="id" title="var">X</span> - <span class="id" title="var">n</span>) = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - <span class="id" title="var">n</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(7)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">n</span> × (<span class="id" title="var">Y</span> + 1) + <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(8)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">n</span> × <span class="id" title="var">Y</span> + <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(9)    <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">n</span> × <span class="id" title="var">Y</span> + <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ ¬(<span class="id" title="var">n</span> ≤ <span class="id" title="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(10)    <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">n</span> × <span class="id" title="var">Y</span> + <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> &lt; <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    Assertions (4), (5), (8), and (9) are derived mechanically from
    the invariant and the loop's guard.  Assertions (8), (7), and (6)
    are derived using the assignment rule going backwards from (8)
    to (6).  Assertions (4), (3), and (2) are again backwards
    applications of the assignment rule.

<div class="paragraph"> </div>

    Now that we've decorated the program it only remains to check that
    the uses of the consequence rule are correct -- i.e., that (1)
    implies (2), that (5) implies (6), and that (9) implies (10). This
    is indeed the case:
<ul class="doclist">
<li> (1) <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> (2):  trivial, by algebra.

</li>
<li> (5) <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> (6):  because <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">≤</span> <span class="inlinecode"><span class="id" title="var">X</span></span>, we are guaranteed that the
        subtraction in (6) does not get zero-truncated.  We can
        therefore rewrite (6) as <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">×</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">n</span></span> and cancel the
        <span class="inlinecode"><span class="id" title="var">n</span></span>s, which results in the left conjunct of (5).

</li>
<li> (9) <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> (10):  if <span class="inlinecode">¬</span> <span class="inlinecode">(<span class="id" title="var">n</span></span> <span class="inlinecode">≤</span> <span class="inlinecode"><span class="id" title="var">X</span>)</span> then <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">&lt;</span> <span class="inlinecode"><span class="id" title="var">n</span></span>.  That's straightforward
        from high-school algebra.

</li>
</ul>
    So, we have a valid decorated program. 
</div>

<div class="doc">
<a id="lab99"></a><h1 class="section">Finding Loop Invariants</h1>

<div class="paragraph"> </div>

 Once the outermost precondition and postcondition are
    chosen, the only creative part in verifying programs using Hoare
    Logic is finding the right loop invariants.  The reason this is
    difficult is the same as the reason that inductive mathematical
    proofs are:

<div class="paragraph"> </div>

<ul class="doclist">
<li> Strengthening the *loop invariant* means that you have a stronger
      assumption to work with when trying to establish the
      postcondition of the loop body, but it also means that the loop
      body's postcondition is stronger and thus harder to prove.

<div class="paragraph"> </div>


</li>
<li> Strengthening the *induction hypothesis* means that you have a
      stronger assumption to work with when trying to complete the
      induction step of the proof, but it also means that the
      statement being proved inductively is stronger and thus harder
      to prove.

</li>
</ul>

<div class="paragraph"> </div>

    This section explains how to approach the challenge of finding
    loop invariants through a series of examples and exercises. 
<div class="paragraph"> </div>

<a id="lab100"></a><h2 class="section">Example: Slow Subtraction</h2>

<div class="paragraph"> </div>

 The following program subtracts the value of <span class="inlinecode"><span class="id" title="var">X</span></span> from the value of
    <span class="inlinecode"><span class="id" title="var">Y</span></span> by repeatedly decrementing both <span class="inlinecode"><span class="id" title="var">X</span></span> and <span class="inlinecode"><span class="id" title="var">Y</span></span>.  We want to verify its
    correctness with respect to the pre- and postconditions shown:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

 To verify this program, we need to find an invariant <span class="inlinecode"><span class="id" title="var">Inv</span></span> for the
    loop.  As a first step we can leave <span class="inlinecode"><span class="id" title="var">Inv</span></span> as an unknown and build a
    <i>skeleton</i> for the proof by applying the rules for local
    consistency (working from the end of the program to the beginning,
    as usual, and without any thinking at all yet).

<div class="paragraph"> </div>

    This leads to the following skeleton:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(1)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>               (<span class="id" title="var">a</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(2)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Inv</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(3)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Inv</span> ∧ <span class="id" title="var">X</span> ≠ 0 <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>              (<span class="id" title="var">c</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(4)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Inv</span> [<span class="id" title="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" title="var">X</span>-1] [<span class="id" title="var">Y</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" title="var">Y</span>-1] <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(5)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Inv</span> [<span class="id" title="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" title="var">X</span>-1] <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(6)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Inv</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(7)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Inv</span> ∧ ¬(<span class="id" title="var">X</span> ≠ 0) <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>            (<span class="id" title="var">b</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(8)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    By examining this skeleton, we can see that any valid <span class="inlinecode"><span class="id" title="var">Inv</span></span> will
    have to respect three conditions:
<ul class="doclist">
<li> (a) it must be <i>weak</i> enough to be implied by the loop's
      precondition, i.e., (1) must imply (2);

</li>
<li> (b) it must be <i>strong</i> enough to imply the program's postcondition,
      i.e., (7) must imply (8);

</li>
<li> (c) it must be <i>preserved</i> by each iteration of the loop (given
      that the loop guard evaluates to true), i.e., (3) must imply (4). 
</li>
</ul>

<div class="paragraph"> </div>

 These conditions are actually independent of the particular
    program and specification we are considering: every loop
    invariant has to satisfy them. One way to find an invariant that
    simultaneously satisfies these three conditions is by using an
    iterative process: start with a "candidate" invariant (e.g., a
    guess or a heuristic choice) and check the three conditions above;
    if any of the checks fails, try to use the information that we get
    from the failure to produce another -- hopefully better -- candidate
    invariant, and repeat.

<div class="paragraph"> </div>

    For instance, in the reduce-to-zero example above, we saw that,
    for a very simple loop, choosing <span class="inlinecode"><span class="id" title="var">True</span></span> as an invariant did the
    job.  So let's try instantiating <span class="inlinecode"><span class="id" title="var">Inv</span></span> with <span class="inlinecode"><span class="id" title="var">True</span></span> in the skeleton
    above and see what we get...
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(1)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>       (<span class="id" title="var">a</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(2)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(3)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> ∧ <span class="id" title="var">X</span> ≠ 0 <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>    (<span class="id" title="var">c</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(4)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(5)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(6)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(7)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> ∧ ~(<span class="id" title="var">X</span> ≠ 0) <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>       (<span class="id" title="var">b</span> - <span class="id" title="var">WRONG</span>!)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(8)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    While conditions (a) and (c) are trivially satisfied, condition
    (b) is wrong, i.e., it is not the case that <span class="inlinecode"><span class="id" title="var">True</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span> (7)
    implies <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">m</span></span> (8).  In fact, the two assertions are
    completely unrelated, so it is very easy to find a counterexample
    to the implication (say, <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span> and <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span>).

<div class="paragraph"> </div>

    If we want (b) to hold, we need to strengthen the invariant so
    that it implies the postcondition (8).  One simple way to do
    this is to let the invariant <i>be</i> the postcondition.  So let's
    return to our skeleton, instantiate <span class="inlinecode"><span class="id" title="var">Inv</span></span> with <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">m</span></span>, and
    check conditions (a) to (c) again.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;(1)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>          (<span class="id" title="var">a</span> - <span class="id" title="var">WRONG</span>!)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(2)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(3)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> ≠ 0 <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>   (<span class="id" title="var">c</span> - <span class="id" title="var">WRONG</span>!)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(4)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> - 1 = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(5)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(6)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(7)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> ∧ ~(<span class="id" title="var">X</span> ≠ 0) <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>      (<span class="id" title="var">b</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(8)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    This time, condition (b) holds trivially, but (a) and (c) are
    broken. Condition (a) requires that (1) <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span>
    implies (2) <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">m</span></span>.  If we substitute <span class="inlinecode"><span class="id" title="var">Y</span></span> by <span class="inlinecode"><span class="id" title="var">n</span></span> we have to
    show that <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">m</span></span> for arbitrary <span class="inlinecode"><span class="id" title="var">m</span></span> and <span class="inlinecode"><span class="id" title="var">n</span></span>, which is not
    the case (for instance, when <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span>).  Condition (c) requires
    that <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">-</span> <span class="inlinecode">1</span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">m</span></span>, which fails, for instance, for <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span>
    and <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span>. So, although <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">m</span></span> holds at the end of the loop,
    it does not hold from the start, and it doesn't hold on each
    iteration; it is not a correct invariant.

<div class="paragraph"> </div>

    This failure is not very surprising: the variable <span class="inlinecode"><span class="id" title="var">Y</span></span> changes
    during the loop, while <span class="inlinecode"><span class="id" title="var">m</span></span> and <span class="inlinecode"><span class="id" title="var">n</span></span> are constant, so the assertion
    we chose didn't have much chance of being an invariant!

<div class="paragraph"> </div>

    To do better, we need to generalize (8) to some statement that is
    equivalent to (8) when <span class="inlinecode"><span class="id" title="var">X</span></span> is <span class="inlinecode">0</span>, since this will be the case
    when the loop terminates, and that "fills the gap" in some
    appropriate way when <span class="inlinecode"><span class="id" title="var">X</span></span> is nonzero.  Looking at how the loop
    works, we can observe that <span class="inlinecode"><span class="id" title="var">X</span></span> and <span class="inlinecode"><span class="id" title="var">Y</span></span> are decremented together
    until <span class="inlinecode"><span class="id" title="var">X</span></span> reaches <span class="inlinecode">0</span>.  So, if <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">2</span> and <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode">5</span> initially,
    after one iteration of the loop we obtain <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span> and <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode">4</span>;
    after two iterations <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span> and <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode">3</span>; and then the loop stops.
    Notice that the difference between <span class="inlinecode"><span class="id" title="var">Y</span></span> and <span class="inlinecode"><span class="id" title="var">X</span></span> stays constant
    between iterations: initially, <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span> and <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span>, and the
    difference is always <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">m</span></span>.  So let's try instantiating <span class="inlinecode"><span class="id" title="var">Inv</span></span> in
    the skeleton above with <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">m</span></span>.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;(1)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>               (<span class="id" title="var">a</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(2)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> - <span class="id" title="var">X</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(3)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> - <span class="id" title="var">X</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> ≠ 0 <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>    (<span class="id" title="var">c</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(4)        <span style='letter-spacing:-.4em;'>{</span>{ (<span class="id" title="var">Y</span> - 1) - (<span class="id" title="var">X</span> - 1) = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(5)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> - (<span class="id" title="var">X</span> - 1) = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(6)        <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> - <span class="id" title="var">X</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(7)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> - <span class="id" title="var">X</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> ∧ ~(<span class="id" title="var">X</span> ≠ 0) <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>       (<span class="id" title="var">b</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(8)      <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> - <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    Success!  Conditions (a), (b) and (c) all hold now.  (To
    verify (c), we need to check that, under the assumption that <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">≠</span>
    <span class="inlinecode">0</span>, we have <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">(<span class="id" title="var">Y</span></span> <span class="inlinecode">-</span> <span class="inlinecode">1)</span> <span class="inlinecode">-</span> <span class="inlinecode">(<span class="id" title="var">X</span></span> <span class="inlinecode">-</span> <span class="inlinecode">1)</span>; this holds for all
    natural numbers <span class="inlinecode"><span class="id" title="var">X</span></span> and <span class="inlinecode"><span class="id" title="var">Y</span></span>.) 
</div>

<div class="doc">
<a id="lab101"></a><h2 class="section">Exercise: Slow Assignment</h2>

<div class="paragraph"> </div>

<a id="lab102"></a><h4 class="section">Exercise: 2 stars, standard (slow_assignment)</h4>
 A roundabout way of assigning a number currently stored in <span class="inlinecode"><span class="id" title="var">X</span></span> to
    the variable <span class="inlinecode"><span class="id" title="var">Y</span></span> is to start <span class="inlinecode"><span class="id" title="var">Y</span></span> at <span class="inlinecode">0</span>, then decrement <span class="inlinecode"><span class="id" title="var">X</span></span> until
    it hits <span class="inlinecode">0</span>, incrementing <span class="inlinecode"><span class="id" title="var">Y</span></span> at each step. Here is a program that
    implements this idea:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    Write an informal decorated program showing that this procedure
    is correct, and justify each use of <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>. 
</div>
<div class="code">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" title="keyword">Definition</span> <a id="manual_grade_for_decorations_in_slow_assignment" class="idref" href="#manual_grade_for_decorations_in_slow_assignment"><span class="id" title="definition">manual_grade_for_decorations_in_slow_assignment</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#option"><span class="id" title="inductive">option</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#11c698c8685bb8ab1cf725545c085ac<sub>4</sub>"><span class="id" title="notation">×</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#None"><span class="id" title="constructor">None</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab103"></a><h2 class="section">Exercise: Slow Addition</h2>

<div class="paragraph"> </div>

<a id="lab104"></a><h4 class="section">Exercise: 3 stars, standard, optional (add_slowly_decoration)</h4>
 The following program adds the variable X into the variable Z
    by repeatedly decrementing X and incrementing Z.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span>
</span>    Following the pattern of the <span class="inlinecode"><span class="id" title="var">subtract_slowly</span></span> example above, pick
    a precondition and postcondition that give an appropriate
    specification of <span class="inlinecode"><span class="id" title="var">add_slowly</span></span>; then (informally) decorate the
    program accordingly, and justify each use of <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>. 
</div>
<div class="code">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab105"></a><h2 class="section">Example: Parity</h2>

<div class="paragraph"> </div>

 Here is a cute little program for computing the parity of the
    value initially stored in <span class="inlinecode"><span class="id" title="var">X</span></span> (due to Daniel Cristofani).
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> 2 ≤ <span class="id" title="var">X</span> <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">parity</span> <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    The mathematical <span class="inlinecode"><span class="id" title="var">parity</span></span> function used in the specification is
    defined in Coq as follows: 
</div>
<div class="code">

<span class="id" title="keyword">Fixpoint</span> <a id="parity" class="idref" href="#parity"><span class="id" title="definition">parity</span></a> <a id="x:1" class="idref" href="#x:1"><span class="id" title="binder">x</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <a class="idref" href="Hoare2.html#x:1"><span class="id" title="variable">x</span></a> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| 0 ⇒ 0<br/>
&nbsp;&nbsp;| 1 ⇒ 1<br/>
&nbsp;&nbsp;| <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> <span class="id" title="var">x'</span>) ⇒ <a class="idref" href="Hoare2.html#parity:2"><span class="id" title="definition">parity</span></a> <span class="id" title="var">x'</span><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.<br/>
</div>

<div class="doc">
The postcondition does not hold at the beginning of the loop,
    since <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">parity</span></span> <span class="inlinecode"><span class="id" title="var">m</span></span> does not hold for an arbitrary <span class="inlinecode"><span class="id" title="var">m</span></span>, so we
    cannot use that as an invariant.  To find an invariant that works,
    let's think a bit about what this loop does.  On each iteration it
    decrements <span class="inlinecode"><span class="id" title="var">X</span></span> by <span class="inlinecode">2</span>, which preserves the parity of <span class="inlinecode"><span class="id" title="var">X</span></span>.  So the
    parity of <span class="inlinecode"><span class="id" title="var">X</span></span> does not change, i.e., it is invariant.  The initial
    value of <span class="inlinecode"><span class="id" title="var">X</span></span> is <span class="inlinecode"><span class="id" title="var">m</span></span>, so the parity of <span class="inlinecode"><span class="id" title="var">X</span></span> is always equal to the
    parity of <span class="inlinecode"><span class="id" title="var">m</span></span>. Using <span class="inlinecode"><span class="id" title="var">parity</span></span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">parity</span></span> <span class="inlinecode"><span class="id" title="var">m</span></span> as an invariant we
    obtain the following decorated program:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>                               (<span class="id" title="var">a</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">parity</span> <span class="id" title="var">X</span> = <span class="id" title="var">parity</span> <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> 2 ≤ <span class="id" title="var">X</span> <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">parity</span> <span class="id" title="var">X</span> = <span class="id" title="var">parity</span> <span class="id" title="var">m</span> ∧ 2 ≤ <span class="id" title="var">X</span> <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>    (<span class="id" title="var">c</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">parity</span> (<span class="id" title="var">X</span>-2) = <span class="id" title="var">parity</span> <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">parity</span> <span class="id" title="var">X</span> = <span class="id" title="var">parity</span> <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">parity</span> <span class="id" title="var">X</span> = <span class="id" title="var">parity</span> <span class="id" title="var">m</span> ∧ ~(2 ≤ <span class="id" title="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>       (<span class="id" title="var">b</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">parity</span> <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    With this invariant, conditions (a), (b), and (c) are all
    satisfied. For verifying (b), we observe that, when <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">&lt;</span> <span class="inlinecode">2</span>, we
    have <span class="inlinecode"><span class="id" title="var">parity</span></span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">X</span></span> (we can easily see this in the definition of
    <span class="inlinecode"><span class="id" title="var">parity</span></span>).  For verifying (c), we observe that, when <span class="inlinecode">2</span> <span class="inlinecode">≤</span> <span class="inlinecode"><span class="id" title="var">X</span></span>, we
    have <span class="inlinecode"><span class="id" title="var">parity</span></span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">parity</span></span> <span class="inlinecode">(<span class="id" title="var">X</span>-2)</span>. 
<div class="paragraph"> </div>

<a id="lab106"></a><h4 class="section">Exercise: 3 stars, standard, optional (parity_formal)</h4>
 Translate the above informal decorated program into a formal proof
    in Coq. Your proof should use the Hoare logic rules and should not
    unfold <span class="inlinecode"><span class="id" title="var">hoare_triple</span></span>. Refer to <span class="inlinecode"><span class="id" title="var">reduce_to_zero</span></span> for an example.

<div class="paragraph"> </div>

    To formally state the invariant, you will need the <span class="inlinecode"><span class="id" title="var">ap</span></span> operator
    to apply <span class="inlinecode"><span class="id" title="var">parity</span></span> to an Imp variable --e.g., <span class="inlinecode"><span class="id" title="var">ap</span></span> <span class="inlinecode"><span class="id" title="var">parity</span></span> <span class="inlinecode"><span class="id" title="var">X</span></span>.

<div class="paragraph"> </div>

    After using <span class="inlinecode"><span class="id" title="var">verify_assn</span></span>, you will be left needing to prove some facts
    about <span class="inlinecode"><span class="id" title="var">parity</span></span>. The following lemmas will be helpful, as will
    <span class="inlinecode"><span class="id" title="var">leb_complete</span></span> and <span class="inlinecode"><span class="id" title="var">leb_correct</span></span>. 
</div>
<div class="code">

<span class="id" title="keyword">Lemma</span> <a id="parity_ge_2" class="idref" href="#parity_ge_2"><span class="id" title="lemma">parity_ge_2</span></a> : <span class="id" title="keyword">∀</span> <a id="x:4" class="idref" href="#x:4"><span class="id" title="binder">x</span></a>,<br/>
&nbsp;&nbsp;2 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#x:4"><span class="id" title="variable">x</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#parity"><span class="id" title="definition">parity</span></a> (<a class="idref" href="Hoare2.html#x:4"><span class="id" title="variable">x</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 2) <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#parity"><span class="id" title="definition">parity</span></a> <a class="idref" href="Hoare2.html#x:4"><span class="id" title="variable">x</span></a>.<br/>
<div class="togglescript" id="proofcontrol2" onclick="toggleDisplay('proof2');toggleDisplay('proofcontrol2')"><span class="show"></span></div>
<div class="proofscript" id="proof2" onclick="toggleDisplay('proof2');toggleDisplay('proofcontrol2')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">induction</span> <span class="id" title="var">x</span>; <span class="id" title="tactic">intros</span>; <span class="id" title="tactic">simpl</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">destruct</span> <span class="id" title="var">x</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="var">lia</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">inversion</span> <span class="id" title="var">H</span>; <span class="id" title="tactic">subst</span>; <span class="id" title="tactic">simpl</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;× <span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;× <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.sub_0_r"><span class="id" title="lemma">sub_0_r</span></a>. <span class="id" title="tactic">reflexivity</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<br/>
<span class="id" title="keyword">Lemma</span> <a id="parity_lt_2" class="idref" href="#parity_lt_2"><span class="id" title="lemma">parity_lt_2</span></a> : <span class="id" title="keyword">∀</span> <a id="x:5" class="idref" href="#x:5"><span class="id" title="binder">x</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">¬</span></a> 2 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#x:5"><span class="id" title="variable">x</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#parity"><span class="id" title="definition">parity</span></a> <a class="idref" href="Hoare2.html#x:5"><span class="id" title="variable">x</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#x:5"><span class="id" title="variable">x</span></a>.<br/>
<div class="togglescript" id="proofcontrol3" onclick="toggleDisplay('proof3');toggleDisplay('proofcontrol3')"><span class="show"></span></div>
<div class="proofscript" id="proof3" onclick="toggleDisplay('proof3');toggleDisplay('proofcontrol3')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">induction</span> <span class="id" title="var">x</span>; <span class="id" title="tactic">intros</span>; <span class="id" title="tactic">simpl</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">destruct</span> <span class="id" title="var">x</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="var">lia</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<br/>
<span class="id" title="keyword">Theorem</span> <a id="parity_correct" class="idref" href="#parity_correct"><span class="id" title="lemma">parity_correct</span></a> : <span class="id" title="keyword">∀</span> (<a id="m:6" class="idref" href="#m:6"><span class="id" title="binder">m</span></a>:<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>),<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:6"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="notation">while</span> 2 <span class="id" title="notation">≤</span> <span class="id" title="definition">X</span> <span class="id" title="notation">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> 2<br/>
&nbsp;&nbsp;<span class="id" title="notation">end</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a>  <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#parity"><span class="id" title="definition">parity</span></a> <a class="idref" href="Hoare2.html#m:6"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab107"></a><h2 class="section">Example: Finding Square Roots</h2>

<div class="paragraph"> </div>

 The following program computes the integer square root of <span class="inlinecode"><span class="id" title="var">X</span></span>
    by naive iteration:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span>=<span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> (<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1) ≤ <span class="id" title="var">X</span> <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span>+1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span>≤<span class="id" title="var">m</span> ∧ <span class="id" title="var">m</span>&lt;(<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1) <span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

 As above, we can try to use the postcondition as a candidate
    invariant, obtaining the following decorated program:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;(1)  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span>=<span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>           (<span class="id" title="var">a</span> - <span class="id" title="var">second</span> <span class="id" title="var">conjunct</span> <span class="id" title="keyword">of</span> (2) <span class="id" title="var">WRONG</span>!)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(2)  <span style='letter-spacing:-.4em;'>{</span>{ 0*0 ≤ <span class="id" title="var">m</span> ∧ <span class="id" title="var">m</span>&lt;(0+1)*(0+1) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(3)  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span> ≤ <span class="id" title="var">m</span> ∧ <span class="id" title="var">m</span>&lt;(<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> (<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1) ≤ <span class="id" title="var">X</span> <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(4)    <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span>≤<span class="id" title="var">m</span> ∧ (<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1)&lt;=<span class="id" title="var">X</span> <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>             (<span class="id" title="var">c</span> - <span class="id" title="var">WRONG</span>!)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(5)    <span style='letter-spacing:-.4em;'>{</span>{ (<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1)&lt;=<span class="id" title="var">m</span> ∧ <span class="id" title="var">m</span>&lt;((<span class="id" title="var">Z</span>+1)+1)*((<span class="id" title="var">Z</span>+1)+1) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span>+1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(6)    <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span>≤<span class="id" title="var">m</span> ∧ <span class="id" title="var">m</span>&lt;(<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(7)  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span>≤<span class="id" title="var">m</span> ∧ <span class="id" title="var">m</span>&lt;(<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1) ∧ ~((<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1)&lt;=<span class="id" title="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> (<span class="id" title="var">b</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(8)  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span>≤<span class="id" title="var">m</span> ∧ <span class="id" title="var">m</span>&lt;(<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1) <span style='letter-spacing:-.4em;'>}</span>}
</span>    This didn't work very well: conditions (a) and (c) both failed.
    Looking at condition (c), we see that the second conjunct of (4)
    is almost the same as the first conjunct of (5), except that (4)
    mentions <span class="inlinecode"><span class="id" title="var">X</span></span> while (5) mentions <span class="inlinecode"><span class="id" title="var">m</span></span>. But note that <span class="inlinecode"><span class="id" title="var">X</span></span> is never
    assigned in this program, so we should always have <span class="inlinecode"><span class="id" title="var">X</span>=<span class="id" title="var">m</span></span>. We
    didn't propagate this information from (1) into the loop
    invariant, but we could!

<div class="paragraph"> </div>

    Also, we don't need the second conjunct of (8), since we can
    obtain it from the negation of the guard -- the third conjunct
    in (7) -- again under the assumption that <span class="inlinecode"><span class="id" title="var">X</span>=<span class="id" title="var">m</span></span>.  This allows
    us to simplify a bit.

<div class="paragraph"> </div>

    So we now try <span class="inlinecode"><span class="id" title="var">X</span>=<span class="id" title="var">m</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">Z</span>×<span class="id" title="var">Z</span></span> <span class="inlinecode">≤</span> <span class="inlinecode"><span class="id" title="var">m</span></span> as the loop invariant:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span>=<span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>                                      (<span class="id" title="var">a</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span>=<span class="id" title="var">m</span> ∧ 0*0 ≤ <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span>=<span class="id" title="var">m</span> ∧ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span> ≤ <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> (<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1) ≤ <span class="id" title="var">X</span> <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span>=<span class="id" title="var">m</span> ∧ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span>≤<span class="id" title="var">m</span> ∧ (<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1)&lt;=<span class="id" title="var">X</span> <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>        (<span class="id" title="var">c</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span>=<span class="id" title="var">m</span> ∧ (<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1)&lt;=<span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span>=<span class="id" title="var">m</span> ∧ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span>≤<span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span>=<span class="id" title="var">m</span> ∧ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span>≤<span class="id" title="var">m</span> ∧ ~((<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1)&lt;=<span class="id" title="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>}  <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>           (<span class="id" title="var">b</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span>×<span class="id" title="var">Z</span>≤<span class="id" title="var">m</span> ∧ <span class="id" title="var">m</span>&lt;(<span class="id" title="var">Z</span>+1)*(<span class="id" title="var">Z</span>+1) <span style='letter-spacing:-.4em;'>}</span>}
</span>    This works, since conditions (a), (b), and (c) are now all
    trivially satisfied.

<div class="paragraph"> </div>

    Very often, if a variable is used in a loop in a read-only
    fashion (i.e., it is referred to by the program or by the
    specification and it is not changed by the loop), it is necessary
    to add the fact that it doesn't change to the loop invariant. 
</div>

<div class="doc">
<a id="lab108"></a><h2 class="section">Example: Squaring</h2>

<div class="paragraph"> </div>

 Here is a program that squares <span class="inlinecode"><span class="id" title="var">X</span></span> by repeated addition:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">Y</span> := 0;<br/>
&nbsp;&nbsp;<span class="id" title="var">Z</span> := 0;<br/>
&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">Y</span> = <span class="id" title="var">X</span>)  <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + <span class="id" title="var">X</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> + 1<br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

 The first thing to note is that the loop reads <span class="inlinecode"><span class="id" title="var">X</span></span> but doesn't
    change its value. As we saw in the previous example, it can be a good idea
    in such cases to add <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span> to the invariant.  The other thing
    that we know is often useful in the invariant is the postcondition,
    so let's add that too, leading to the candidate invariant
    <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">×</span> <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span>.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>                            (<span class="id" title="var">a</span> - <span class="id" title="var">WRONG</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ 0 = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ 0 = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">Y</span> = <span class="id" title="var">X</span>) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Y</span> ≠ <span class="id" title="var">X</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>     (<span class="id" title="var">c</span> - <span class="id" title="var">WRONG</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span>+<span class="id" title="var">X</span> = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + <span class="id" title="var">X</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ ~(<span class="id" title="var">Y</span> ≠ <span class="id" title="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>         (<span class="id" title="var">b</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

    Conditions (a) and (c) fail because of the <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span>×<span class="id" title="var">m</span></span> part.  While
    <span class="inlinecode"><span class="id" title="var">Z</span></span> starts at <span class="inlinecode">0</span> and works itself up to <span class="inlinecode"><span class="id" title="var">m</span>×<span class="id" title="var">m</span></span>, we can't expect
    <span class="inlinecode"><span class="id" title="var">Z</span></span> to be <span class="inlinecode"><span class="id" title="var">m</span>×<span class="id" title="var">m</span></span> from the start.  If we look at how <span class="inlinecode"><span class="id" title="var">Z</span></span> progresses
    in the loop, after the 1st iteration <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span>, after the 2nd
    iteration <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode">2*<span class="id" title="var">m</span></span>, and at the end <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span>×<span class="id" title="var">m</span></span>.  Since the variable
    <span class="inlinecode"><span class="id" title="var">Y</span></span> tracks how many times we go through the loop, this leads us to
    derive a new invariant candidate: <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">Y</span>×<span class="id" title="var">m</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span>.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>                               (<span class="id" title="var">a</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ 0 = 0*<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ 0 = <span class="id" title="var">Y</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">Y</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">Y</span> = <span class="id" title="var">X</span>) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">Y</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Y</span> ≠ <span class="id" title="var">X</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>        (<span class="id" title="var">c</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span>+<span class="id" title="var">X</span> = (<span class="id" title="var">Y</span>+1)*<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + <span class="id" title="var">X</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = (<span class="id" title="var">Y</span>+1)*<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">Y</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">Y</span>×<span class="id" title="var">m</span> ∧ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ ~(<span class="id" title="var">Y</span> ≠ <span class="id" title="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>           (<span class="id" title="var">b</span> - <span class="id" title="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">m</span>×<span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

    This new invariant makes the proof go through: all three
    conditions are easy to check.

<div class="paragraph"> </div>

    It is worth comparing the postcondition <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span>×<span class="id" title="var">m</span></span> and the <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">=</span>
    <span class="inlinecode"><span class="id" title="var">Y</span>×<span class="id" title="var">m</span></span> conjunct of the invariant. It is often the case that one has
    to replace parameters with variables -- or with expressions
    involving both variables and parameters, like <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> -- when
    going from postconditions to invariants. 
</div>

<div class="doc">
<a id="lab109"></a><h2 class="section">Exercise: Factorial</h2>

<div class="paragraph"> </div>

<a id="lab110"></a><h4 class="section">Exercise: 3 stars, standard (factorial)</h4>
 Recall that <span class="inlinecode"><span class="id" title="var">n</span>!</span> denotes the factorial of <span class="inlinecode"><span class="id" title="var">n</span></span> (i.e., <span class="inlinecode"><span class="id" title="var">n</span>!</span> <span class="inlinecode">=</span>
    <span class="inlinecode">1*2*...*<span class="id" title="var">n</span></span>).  Here is an Imp program that calculates the factorial
    of the number initially stored in the variable <span class="inlinecode"><span class="id" title="var">X</span></span> and puts it in
    the variable <span class="inlinecode"><span class="id" title="var">Y</span></span>:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">Y</span> := 1 ;<br/>
&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0)<br/>
&nbsp;&nbsp;<span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> × <span class="id" title="var">X</span> ;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">m</span>! <span style='letter-spacing:-.4em;'>}</span>}
</span>    Fill in the blanks in following decorated program. Bear in mind
    that we are working with natural numbers, for which both division
    and subtraction can behave differently than with real numbers.
    Excluding both operations from your loop invariant is advisable.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                      <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">Y</span> := 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                      <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0)<br/>
&nbsp;&nbsp;<span class="id" title="tactic">do</span>   <span style='letter-spacing:-.4em;'>{</span>{                                      <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                      <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> × <span class="id" title="var">X</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                      <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                      <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                      <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">m</span>! <span style='letter-spacing:-.4em;'>}</span>}
</span>    Briefly justify each use of <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>.

</div>
<div class="code">

<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" title="keyword">Definition</span> <a id="manual_grade_for_decorations_in_factorial" class="idref" href="#manual_grade_for_decorations_in_factorial"><span class="id" title="definition">manual_grade_for_decorations_in_factorial</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#option"><span class="id" title="inductive">option</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#11c698c8685bb8ab1cf725545c085ac<sub>4</sub>"><span class="id" title="notation">×</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#None"><span class="id" title="constructor">None</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab111"></a><h2 class="section">Exercise: Min</h2>

<div class="paragraph"> </div>

<a id="lab112"></a><h4 class="section">Exercise: 3 stars, standard (Min_Hoare)</h4>

<div class="paragraph"> </div>

 Fill in valid decorations for the following program, and justify
    the uses of <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>.  As in <span class="inlinecode"><span class="id" title="var">factorial</span></span>, be careful about natural
    numbers, especially subtraction.

<div class="paragraph"> </div>

    In your justifications, you may rely on the following facts about min:
<br/>
<span class="inlinecode">&nbsp;&nbsp;<span class="id" title="keyword">Lemma</span> <span class="id" title="var">lemma1</span> : <span class="id" title="keyword">∀</span> <span class="id" title="var">x</span> <span class="id" title="var">y</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="var">x</span>&lt;&gt;0 ∧ <span class="id" title="var">y</span>&lt;&gt;0) → <span class="id" title="var">min</span> <span class="id" title="var">x</span> <span class="id" title="var">y</span> ≠ 0.<br/>
&nbsp;&nbsp;<span class="id" title="keyword">Lemma</span> <span class="id" title="var">lemma2</span> : <span class="id" title="keyword">∀</span> <span class="id" title="var">x</span> <span class="id" title="var">y</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">min</span> (<span class="id" title="var">x</span>-1) (<span class="id" title="var">y</span>-1) = (<span class="id" title="var">min</span> <span class="id" title="var">x</span> <span class="id" title="var">y</span>) - 1.
</span>    plus standard high-school algebra, as always. 
<div class="paragraph"> </div>


<div class="paragraph"> </div>

<br/>
<span class="inlinecode">&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                    <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">a</span>;<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                       <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">b</span>;<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                       <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">Z</span> := 0;<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                       <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) &amp;&amp; ~(<span class="id" title="var">Y</span> = 0) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                     <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                            <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> - 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                       <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                            <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">min</span> <span class="id" title="var">a</span> <span class="id" title="var">b</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
</div>
<div class="code">

<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" title="keyword">Definition</span> <a id="manual_grade_for_decorations_in_Min_Hoare" class="idref" href="#manual_grade_for_decorations_in_Min_Hoare"><span class="id" title="definition">manual_grade_for_decorations_in_Min_Hoare</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#option"><span class="id" title="inductive">option</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#11c698c8685bb8ab1cf725545c085ac<sub>4</sub>"><span class="id" title="notation">×</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#None"><span class="id" title="constructor">None</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab113"></a><h4 class="section">Exercise: 3 stars, standard (two_loops)</h4>
 Here is a very inefficient way of adding 3 numbers:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">c</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = <span class="id" title="var">a</span>) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> + 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">Y</span> = <span class="id" title="var">b</span>) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> + 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span>
</span>    Show that it does what it should by filling in the blanks in the
    following decorated program.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">c</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = <span class="id" title="var">a</span>) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> + 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">Y</span> = <span class="id" title="var">b</span>) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> + 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{                                        <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Z</span> = <span class="id" title="var">a</span> + <span class="id" title="var">b</span> + <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
</div>
<div class="code">

<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" title="keyword">Definition</span> <a id="manual_grade_for_decorations_in_two_loops" class="idref" href="#manual_grade_for_decorations_in_two_loops"><span class="id" title="definition">manual_grade_for_decorations_in_two_loops</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#option"><span class="id" title="inductive">option</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#11c698c8685bb8ab1cf725545c085ac<sub>4</sub>"><span class="id" title="notation">×</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#None"><span class="id" title="constructor">None</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab114"></a><h2 class="section">Exercise: Power Series</h2>

<div class="paragraph"> </div>

<a id="lab115"></a><h4 class="section">Exercise: 4 stars, standard, optional (dpow2_down)</h4>
 Here is a program that computes the series:
    <span class="inlinecode">1</span> <span class="inlinecode">+</span> <span class="inlinecode">2</span> <span class="inlinecode">+</span> <span class="inlinecode">2^2</span> <span class="inlinecode">+</span> <span class="inlinecode">...</span> <span class="inlinecode">+</span> <span class="inlinecode">2^<span class="id" title="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode">2^(<span class="id" title="var">m</span>+1)</span> <span class="inlinecode">-</span> <span class="inlinecode">1</span>
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = <span class="id" title="var">m</span>) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := 2 × <span class="id" title="var">Z</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> + <span class="id" title="var">Z</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span>
</span>    Write a decorated program for this, and justify each use of <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>. 
</div>
<div class="code">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab116"></a><h1 class="section">Weakest Preconditions (Optional)</h1>

<div class="paragraph"> </div>

 Some preconditions are more interesting than others.
    For example,
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">False</span> <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">Y</span> + 1  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> ≤ 5 <span style='letter-spacing:-.4em;'>}</span>}
</span>    is <i>not</i> very interesting: although it is perfectly valid Hoare
    triple, it tells us nothing useful.  Since the precondition isn't
    satisfied by any state, it doesn't describe any situations where
    we can use the command <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> to achieve the postcondition
    <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5</span>.

<div class="paragraph"> </div>

    By contrast,
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> ≤ 4 ∧ <span class="id" title="var">Z</span> = 0 <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">Y</span> + 1 <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> ≤ 5 <span style='letter-spacing:-.4em;'>}</span>}
</span>    has a useful precondition: it tells us that, if we can somehow
    create a situation in which we know that <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">4</span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span>, then
    running this command will produce a state satisfying the
    postcondition.  However, this precondition is not as useful as it
    could be, because the <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span> clause in the precondition actually
    has nothing to do with the postcondition <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5</span>.

<div class="paragraph"> </div>

    The most useful precondition is this one:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> ≤ 4 <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">Y</span> + 1  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> ≤ 5 <span style='letter-spacing:-.4em;'>}</span>}
</span>    Assertion <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">4</span> is the <i>weakest precondition</i> of command <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span>
    <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> for postcondition <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5</span>. 
<div class="paragraph"> </div>

 Assertion <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">4</span> is a <i>weakest precondition</i> of command <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span>
    <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> with respect to postcondition <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5</span>.  Think of <i>weakest</i>
    here as meaning "easiest to satisfy": a weakest precondition is
    one that as many states as possible can satisfy.

<div class="paragraph"> </div>

    <span class="inlinecode"><span class="id" title="var">P</span></span> is a weakest precondition of command <span class="inlinecode"><span class="id" title="var">c</span></span> for postcondition <span class="inlinecode"><span class="id" title="var">Q</span></span>
    if:

<div class="paragraph"> </div>

<ul class="doclist">
<li> <span class="inlinecode"><span class="id" title="var">P</span></span> is a precondition, that is, <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">c</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}</span>; and

</li>
<li> <span class="inlinecode"><span class="id" title="var">P</span></span> is at least as weak as all other preconditions, that is,
        if <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P'</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">c</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}</span> then <span class="inlinecode"><span class="id" title="var">P'</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> <span class="inlinecode"><span class="id" title="var">P</span></span>.

</li>
</ul>
 
<div class="paragraph"> </div>

 Note that weakest preconditions need not be unique.  For
    example, <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">4</span> was a weakest precondition above, but so are the
    logically equivalent assertions <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">&lt;</span> <span class="inlinecode">5</span>, <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">2</span> <span class="inlinecode">×</span> <span class="inlinecode">2</span>, etc.  
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="is_wp" class="idref" href="#is_wp"><span class="id" title="definition">is_wp</span></a> <a id="P:7" class="idref" href="#P:7"><span class="id" title="binder">P</span></a> <a id="c:8" class="idref" href="#c:8"><span class="id" title="binder">c</span></a> <a id="Q:9" class="idref" href="#Q:9"><span class="id" title="binder">Q</span></a> :=<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare2.html#P:7"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#c:8"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare2.html#Q:9"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a><br/>
&nbsp;&nbsp;<span class="id" title="keyword">∀</span> <a id="P':10" class="idref" href="#P':10"><span class="id" title="binder">P'</span></a>, <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare2.html#P':10"><span class="id" title="variable">P'</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#c:8"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare2.html#Q:9"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#P':10"><span class="id" title="variable">P'</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare2.html#P:7"><span class="id" title="variable">P</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">)</span></a>.<br/>
</div>

<div class="doc">
<a id="lab117"></a><h4 class="section">Exercise: 1 star, standard, optional (wp)</h4>
 What are weakest preconditions of the following commands
    for the following postconditions?
<br/>
<span class="inlinecode">&nbsp;&nbsp;1) <span style='letter-spacing:-.4em;'>{</span>{ ? <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">skip</span>  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 5 <span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;2) <span style='letter-spacing:-.4em;'>{</span>{ ? <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">Y</span> + <span class="id" title="var">Z</span> <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 5 <span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;3) <span style='letter-spacing:-.4em;'>{</span>{ ? <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">Y</span>  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">Y</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;4) <span style='letter-spacing:-.4em;'>{</span>{ ? <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">if</span> <span class="id" title="var">X</span> = 0 <span class="id" title="keyword">then</span> <span class="id" title="var">Y</span> := <span class="id" title="var">Z</span> + 1 <span class="id" title="keyword">else</span> <span class="id" title="var">Y</span> := <span class="id" title="var">W</span> + 2 <span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = 5 <span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;5) <span style='letter-spacing:-.4em;'>{</span>{ ? <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 5<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 0 <span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;6) <span style='letter-spacing:-.4em;'>{</span>{ ? <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> <span class="id" title="var">true</span> <span class="id" title="tactic">do</span> <span class="id" title="var">X</span> := 0 <span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 0 <span style='letter-spacing:-.4em;'>}</span>}
</span>
</div>
<div class="code">
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab118"></a><h4 class="section">Exercise: 3 stars, advanced, optional (is_wp_formal)</h4>
 Prove formally, using the definition of <span class="inlinecode"><span class="id" title="var">hoare_triple</span></span>, that <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">4</span>
    is indeed a weakest precondition of <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> with respect to
    postcondition <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5</span>. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="is_wp_example" class="idref" href="#is_wp_example"><span class="id" title="lemma">is_wp_example</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#is_wp"><span class="id" title="definition">is_wp</span></a> (<span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> 4) <span class="id" title="notation">&lt;{</span><span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">Y</span> <span class="id" title="notation">+</span> 1<span class="id" title="notation">}&gt;</span> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> 5).<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab119"></a><h4 class="section">Exercise: 2 stars, advanced, optional (hoare_asgn_weakest)</h4>
 Show that the precondition in the rule <span class="inlinecode"><span class="id" title="var">hoare_asgn</span></span> is in fact the
    weakest precondition. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_asgn_weakest" class="idref" href="#hoare_asgn_weakest"><span class="id" title="lemma">hoare_asgn_weakest</span></a> : <span class="id" title="keyword">∀</span> <a id="Q:11" class="idref" href="#Q:11"><span class="id" title="binder">Q</span></a> <a id="X:12" class="idref" href="#X:12"><span class="id" title="binder">X</span></a> <a id="a:13" class="idref" href="#a:13"><span class="id" title="binder">a</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#is_wp"><span class="id" title="definition">is_wp</span></a> (<a class="idref" href="Hoare2.html#Q:11"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">[</span></a><a class="idref" href="Hoare2.html#X:12"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span></a> <a class="idref" href="Hoare2.html#a:13"><span class="id" title="variable">a</span></a><a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">]</span></a>) <span class="id" title="notation">&lt;{</span> <a class="idref" href="Hoare2.html#X:12"><span class="id" title="variable">X</span></a> <span class="id" title="notation">:=</span> <a class="idref" href="Hoare2.html#a:13"><span class="id" title="variable">a</span></a> <span class="id" title="notation">}&gt;</span> <a class="idref" href="Hoare2.html#Q:11"><span class="id" title="variable">Q</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab120"></a><h4 class="section">Exercise: 2 stars, advanced, optional (hoare_havoc_weakest)</h4>
 Show that your <span class="inlinecode"><span class="id" title="var">havoc_pre</span></span> function from the <span class="inlinecode"><span class="id" title="var">himp_hoare</span></span> exercise
    in the <a href="Hoare.html"><span class="inlineref">Hoare</span></a> chapter returns a weakest precondition. 
</div>
<div class="code">
<span class="id" title="keyword">Module</span> <a id="Himp2" class="idref" href="#Himp2"><span class="id" title="module">Himp2</span></a>.<br/>
<span class="id" title="keyword">Import</span> <span class="id" title="var">Himp</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Lemma</span> <a id="Himp2.hoare_havoc_weakest" class="idref" href="#Himp2.hoare_havoc_weakest"><span class="id" title="lemma">hoare_havoc_weakest</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:14" class="idref" href="#P:14"><span class="id" title="binder">P</span></a> <a id="Q:15" class="idref" href="#Q:15"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="X:16" class="idref" href="#X:16"><span class="id" title="binder">X</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>),<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#P:14"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#Himp.:com::'havoc'_x"><span class="id" title="notation">havoc</span></a> <a class="idref" href="Hoare2.html#X:16"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#Q:15"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#P:14"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#Himp.havoc_pre"><span class="id" title="axiom">havoc_pre</span></a> <a class="idref" href="Hoare2.html#X:16"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare2.html#Q:15"><span class="id" title="variable">Q</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab121"></a><h1 class="section">Formal Decorated Programs (Advanced)</h1>

<div class="paragraph"> </div>

 Our informal conventions for decorated programs amount to a
    way of displaying Hoare triples, in which commands are annotated
    with enough embedded assertions that checking the validity of a
    triple is reduced to simple logical and algebraic calculations
    showing that some assertions imply others.  In this section, we
    show that this presentation style can actually be made completely
    formal -- and indeed that checking the validity of decorated
    programs can mostly be automated.  
<div class="paragraph"> </div>

<a id="lab122"></a><h2 class="section">Syntax</h2>

<div class="paragraph"> </div>

 The first thing we need to do is to formalize a variant of the
    syntax of commands with embedded assertions.  We call the new
    commands <i>decorated commands</i>, or <span class="inlinecode"><span class="id" title="var">dcom</span></span>s.

<div class="paragraph"> </div>

    The choice of exactly where to put assertions in the definition of
    <span class="inlinecode"><span class="id" title="var">dcom</span></span> is a bit subtle.  The simplest thing to do would be to
    annotate every <span class="inlinecode"><span class="id" title="var">dcom</span></span> with a precondition and postcondition.  But
    this would result in very verbose programs with a lot of repeated
    annotations: for example, a program like <span class="inlinecode"><span class="id" title="var">skip</span>;<span class="id" title="var">skip</span></span> would have to
    be annotated as
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>} (<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">skip</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}) ; (<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">skip</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>},
</span>    with pre- and post-conditions on each <span class="inlinecode"><span class="id" title="var">skip</span></span>, plus identical pre-
    and post-conditions on the semicolon!

<div class="paragraph"> </div>

    We don't want both preconditions and postconditions on each
    command, because a sequence of two commands would contain
    redundant decorations--the postcondition of the first likely being
    the same as the precondition of the second.

<div class="paragraph"> </div>

    Instead, we'll omit preconditions whenever possible, trying to
    embed just the postcondition. 
<div class="paragraph"> </div>

 Specifically, we decorate as follows:

<div class="paragraph"> </div>

<ul class="doclist">
<li> Command <span class="inlinecode"><span class="id" title="var">skip</span></span> is decorated only with its postcondition, as
      <span class="inlinecode"><span class="id" title="var">skip</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">Q</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>}</span>}</span>.

<div class="paragraph"> </div>


</li>
<li> Sequence <span class="inlinecode"><span class="id" title="var">d<sub>1</sub></span></span> <span class="inlinecode">;</span> <span class="inlinecode"><span class="id" title="var">d<sub>2</sub></span></span> contains no additional decoration.  Inside
      <span class="inlinecode"><span class="id" title="var">d<sub>2</sub></span></span> there will be a postcondition; that serves as the
      postcondition of <span class="inlinecode"><span class="id" title="var">d<sub>1</sub></span></span> <span class="inlinecode">;</span> <span class="inlinecode"><span class="id" title="var">d<sub>2</sub></span></span>.  Inside <span class="inlinecode"><span class="id" title="var">d<sub>1</sub></span></span> there will also be a
      postcondition; it additionally serves as the precondition for
      <span class="inlinecode"><span class="id" title="var">d<sub>2</sub></span></span>.

<div class="paragraph"> </div>


</li>
<li> Assignment <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">a</span></span> is decorated only with its postcondition,
      as <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">a</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">Q</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>}</span>}</span>.

<div class="paragraph"> </div>


</li>
<li> If statement <span class="inlinecode"><span class="id" title="keyword">if</span></span> <span class="inlinecode"><span class="id" title="var">b</span></span> <span class="inlinecode"><span class="id" title="keyword">then</span></span> <span class="inlinecode"><span class="id" title="var">d<sub>1</sub></span></span> <span class="inlinecode"><span class="id" title="keyword">else</span></span> <span class="inlinecode"><span class="id" title="var">d<sub>2</sub></span></span> is decorated with a
      postcondition for the entire statement, as well as preconditions
      for each branch, as
      <span class="inlinecode"><span class="id" title="keyword">if</span></span> <span class="inlinecode"><span class="id" title="var">b</span></span> <span class="inlinecode"><span class="id" title="keyword">then</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">P<sub>1</sub></span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">d<sub>1</sub></span></span> <span class="inlinecode"><span class="id" title="keyword">else</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">P<sub>2</sub></span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">d<sub>2</sub></span></span> <span class="inlinecode"><span class="id" title="keyword">end</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">Q</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>}</span>}</span>.

<div class="paragraph"> </div>


</li>
<li> While loop <span class="inlinecode"><span class="id" title="var">while</span></span> <span class="inlinecode"><span class="id" title="var">b</span></span> <span class="inlinecode"><span class="id" title="tactic">do</span></span> <span class="inlinecode"><span class="id" title="var">d</span></span> <span class="inlinecode"><span class="id" title="keyword">end</span></span> is decorated with its
      postcondition and a precondition for the body, as
      <span class="inlinecode"><span class="id" title="var">while</span></span> <span class="inlinecode"><span class="id" title="var">b</span></span> <span class="inlinecode"><span class="id" title="tactic">do</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">d</span></span> <span class="inlinecode"><span class="id" title="keyword">end</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">Q</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>}</span>}</span>.  The postcondition inside
      <span class="inlinecode"><span class="id" title="var">d</span></span> serves as the loop invariant.

<div class="paragraph"> </div>


</li>
<li> Implications <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> are added as decorations for a precondition
      as <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">d</span></span>, or for a postcondition as <span class="inlinecode"><span class="id" title="var">d</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">Q</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>}</span>}</span>.
      The former is waiting for another precondition to eventually be
      supplied, e.g., <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">P'</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{</span> <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">d</span></span>, and the latter relies
      on the postcondition already embedded in <span class="inlinecode"><span class="id" title="var">d</span></span>.

</li>
</ul>

</div>
<div class="code">

<span class="id" title="keyword">Inductive</span> <a id="dcom" class="idref" href="#dcom"><span class="id" title="inductive">dcom</span></a> : <span class="id" title="keyword">Type</span> :=<br/>
| <a id="DCSkip" class="idref" href="#DCSkip"><span class="id" title="constructor">DCSkip</span></a> (<a id="Q:19" class="idref" href="#Q:19"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>)<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;skip&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;Q&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;*)</span><br/>
| <a id="DCSeq" class="idref" href="#DCSeq"><span class="id" title="constructor">DCSeq</span></a> (<a id="d<sub>1</sub>:20" class="idref" href="#d<sub>1</sub>:20"><span class="id" title="binder">d<sub>1</sub></span></a> <a id="d<sub>2</sub>:21" class="idref" href="#d<sub>2</sub>:21"><span class="id" title="binder">d<sub>2</sub></span></a> : <a class="idref" href="Hoare2.html#dcom:17"><span class="id" title="inductive">dcom</span></a>)<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;d<sub>1</sub>&nbsp;;&nbsp;d<sub>2</sub>&nbsp;*)</span><br/>
| <a id="DCAsgn" class="idref" href="#DCAsgn"><span class="id" title="constructor">DCAsgn</span></a> (<a id="X:22" class="idref" href="#X:22"><span class="id" title="binder">X</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) (<a id="a:23" class="idref" href="#a:23"><span class="id" title="binder">a</span></a> : <span class="id" title="inductive">aexp</span>) (<a id="Q:24" class="idref" href="#Q:24"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>)<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;X&nbsp;:=&nbsp;a&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;Q&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;*)</span><br/>
| <a id="DCIf" class="idref" href="#DCIf"><span class="id" title="constructor">DCIf</span></a> (<a id="b:25" class="idref" href="#b:25"><span class="id" title="binder">b</span></a> : <span class="id" title="inductive">bexp</span>) (<a id="P<sub>1</sub>:26" class="idref" href="#P<sub>1</sub>:26"><span class="id" title="binder">P<sub>1</sub></span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="d<sub>1</sub>:27" class="idref" href="#d<sub>1</sub>:27"><span class="id" title="binder">d<sub>1</sub></span></a> : <a class="idref" href="Hoare2.html#dcom:17"><span class="id" title="inductive">dcom</span></a>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a id="P<sub>2</sub>:28" class="idref" href="#P<sub>2</sub>:28"><span class="id" title="binder">P<sub>2</sub></span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="d<sub>2</sub>:29" class="idref" href="#d<sub>2</sub>:29"><span class="id" title="binder">d<sub>2</sub></span></a> : <a class="idref" href="Hoare2.html#dcom:17"><span class="id" title="inductive">dcom</span></a>) (<a id="Q:30" class="idref" href="#Q:30"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>)<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;if&nbsp;b&nbsp;then&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;P<sub>1</sub>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;d<sub>1</sub>&nbsp;else&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;P<sub>2</sub>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;d<sub>2</sub>&nbsp;end&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;Q&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;*)</span><br/>
| <a id="DCWhile" class="idref" href="#DCWhile"><span class="id" title="constructor">DCWhile</span></a> (<a id="b:31" class="idref" href="#b:31"><span class="id" title="binder">b</span></a> : <span class="id" title="inductive">bexp</span>) (<a id="P:32" class="idref" href="#P:32"><span class="id" title="binder">P</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="d:33" class="idref" href="#d:33"><span class="id" title="binder">d</span></a> : <a class="idref" href="Hoare2.html#dcom:17"><span class="id" title="inductive">dcom</span></a>) (<a id="Q:34" class="idref" href="#Q:34"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>)<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;while&nbsp;b&nbsp;do&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;P&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;d&nbsp;end&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;Q&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;*)</span><br/>
| <a id="DCPre" class="idref" href="#DCPre"><span class="id" title="constructor">DCPre</span></a> (<a id="P:35" class="idref" href="#P:35"><span class="id" title="binder">P</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="d:36" class="idref" href="#d:36"><span class="id" title="binder">d</span></a> : <a class="idref" href="Hoare2.html#dcom:17"><span class="id" title="inductive">dcom</span></a>)<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;P&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;d&nbsp;*)</span><br/>
| <a id="DCPost" class="idref" href="#DCPost"><span class="id" title="constructor">DCPost</span></a> (<a id="d:37" class="idref" href="#d:37"><span class="id" title="binder">d</span></a> : <a class="idref" href="Hoare2.html#dcom:17"><span class="id" title="inductive">dcom</span></a>) (<a id="Q:38" class="idref" href="#Q:38"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>)<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;d&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;Q&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;*)</span><br/>
.<br/>
</div>

<div class="doc">
<span class="inlinecode"><span class="id" title="var">DCPre</span></span> is used to provide the weakened precondition from
    the rule of consequence. To provide the initial precondition
    at the very top of the program, we use <span class="inlinecode"><span class="id" title="var">Decorated</span></span>: 
</div>
<div class="code">

<span class="id" title="keyword">Inductive</span> <a id="decorated" class="idref" href="#decorated"><span class="id" title="inductive">decorated</span></a> : <span class="id" title="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <a id="Decorated" class="idref" href="#Decorated"><span class="id" title="constructor">Decorated</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare2.html#dcom"><span class="id" title="inductive">dcom</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare2.html#decorated:39"><span class="id" title="inductive">decorated</span></a>.<br/>
</div>

<div class="doc">
To avoid clashing with the existing <span class="inlinecode"><span class="id" title="keyword">Notation</span></span> definitions for
    ordinary <span class="inlinecode"><span class="id" title="var">com</span></span>mands, we introduce these notations in a custom entry
    notation called <span class="inlinecode"><span class="id" title="var">dcom</span></span>. 
</div>
<div class="code">

<div class="togglescript" id="proofcontrol4" onclick="toggleDisplay('proof4');toggleDisplay('proofcontrol4')"><span class="show"></span></div>
<div class="proofscript" id="proof4" onclick="toggleDisplay('proof4');toggleDisplay('proofcontrol4')">
<span class="id" title="var">Declare</span> <span class="id" title="keyword">Scope</span> <span class="id" title="var">dcom_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="96a08d9d8c7f327acf2f44c46454fe1a" class="idref" href="#96a08d9d8c7f327acf2f44c46454fe1a"><span class="id" title="notation">&quot;</span></a>'skip' <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<a class="idref" href="Hoare2.html#DCSkip"><span class="id" title="constructor">DCSkip</span></a> <span class="id" title="var">P</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0, <span class="id" title="var">P</span> <span class="id" title="keyword">constr</span>) : <span class="id" title="var">dcom_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="6fc777e17570559fe34310ebff6e74b<sub>3</sub>" class="idref" href="#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">&quot;</span></a>l ':=' a <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<a class="idref" href="Hoare2.html#DCAsgn"><span class="id" title="constructor">DCAsgn</span></a> <span class="id" title="var">l</span> <span class="id" title="var">a</span> <span class="id" title="var">P</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0, <span class="id" title="var">l</span> <span class="id" title="keyword">constr</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">a</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 85, <span class="id" title="var">P</span> <span class="id" title="keyword">constr</span>, <span class="id" title="keyword">no</span> <span class="id" title="keyword">associativity</span>) : <span class="id" title="var">dcom_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="88a349ad7000af9e3380552dd1d95d<sub>34</sub>" class="idref" href="#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">&quot;</span></a>'while' b 'do' <span style='letter-spacing:-.4em;'>{</span>{ Pbody <span style='letter-spacing:-.4em;'>}</span>} d 'end' <span style='letter-spacing:-.4em;'>{</span>{ Ppost <span style='letter-spacing:-.4em;'>}</span>}"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<a class="idref" href="Hoare2.html#DCWhile"><span class="id" title="constructor">DCWhile</span></a> <span class="id" title="var">b</span> <span class="id" title="var">Pbody</span> <span class="id" title="var">d</span> <span class="id" title="var">Ppost</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 89, <span class="id" title="var">b</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Pbody</span> <span class="id" title="keyword">constr</span>, <span class="id" title="var">Ppost</span> <span class="id" title="keyword">constr</span>) : <span class="id" title="var">dcom_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="19537bd922ef12a4bb3739b50ff7c563" class="idref" href="#19537bd922ef12a4bb3739b50ff7c563"><span class="id" title="notation">&quot;</span></a>'if' b 'then' <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} d 'else' <span style='letter-spacing:-.4em;'>{</span>{ P' <span style='letter-spacing:-.4em;'>}</span>} d' 'end' <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<a class="idref" href="Hoare2.html#DCIf"><span class="id" title="constructor">DCIf</span></a> <span class="id" title="var">b</span> <span class="id" title="var">P</span> <span class="id" title="var">d</span> <span class="id" title="var">P'</span> <span class="id" title="var">d'</span> <span class="id" title="var">Q</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 89, <span class="id" title="var">b</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">P</span> <span class="id" title="keyword">constr</span>, <span class="id" title="var">P'</span> <span class="id" title="keyword">constr</span>, <span class="id" title="var">Q</span> <span class="id" title="keyword">constr</span>) : <span class="id" title="var">dcom_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>" class="idref" href="#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation">&quot;</span></a>'<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>' <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} d"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<a class="idref" href="Hoare2.html#DCPre"><span class="id" title="constructor">DCPre</span></a> <span class="id" title="var">P</span> <span class="id" title="var">d</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 12, <span class="id" title="tactic">right</span> <span class="id" title="keyword">associativity</span>, <span class="id" title="var">P</span> <span class="id" title="keyword">constr</span>) : <span class="id" title="var">dcom_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="d9c679d5e5db96e17592c387975218ee" class="idref" href="#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation">&quot;</span></a>d '<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>' <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<a class="idref" href="Hoare2.html#DCPost"><span class="id" title="constructor">DCPost</span></a> <span class="id" title="var">d</span> <span class="id" title="var">P</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 10, <span class="id" title="tactic">right</span> <span class="id" title="keyword">associativity</span>, <span class="id" title="var">P</span> <span class="id" title="keyword">constr</span>) : <span class="id" title="var">dcom_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="171c4c95468da881f236e87b2dcc4ffa" class="idref" href="#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">&quot;</span></a> d ; d' "<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<a class="idref" href="Hoare2.html#DCSeq"><span class="id" title="constructor">DCSeq</span></a> <span class="id" title="var">d</span> <span class="id" title="var">d'</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 90, <span class="id" title="tactic">right</span> <span class="id" title="keyword">associativity</span>) : <span class="id" title="var">dcom_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="c00c27417ee45ebadf9f604729ad35ca" class="idref" href="#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation">&quot;</span></a><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} d"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<a class="idref" href="Hoare2.html#Decorated"><span class="id" title="constructor">Decorated</span></a> <span class="id" title="var">P</span> <span class="id" title="var">d</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 91, <span class="id" title="var">P</span> <span class="id" title="keyword">constr</span>) : <span class="id" title="var">dcom_scope</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Open</span> <span class="id" title="keyword">Scope</span> <span class="id" title="var">dcom_scope</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="dec0" class="idref" href="#dec0"><span class="id" title="definition">dec0</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span> <a class="idref" href="Hoare2.html#96a08d9d8c7f327acf2f44c46454fe1a"><span class="id" title="notation">skip</span></a> <a class="idref" href="Hoare2.html#96a08d9d8c7f327acf2f44c46454fe1a"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare2.html#96a08d9d8c7f327acf2f44c46454fe1a"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/>
<span class="id" title="keyword">Example</span> <a id="dec1" class="idref" href="#dec1"><span class="id" title="definition">dec1</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> <span class="id" title="notation">true</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#96a08d9d8c7f327acf2f44c46454fe1a"><span class="id" title="notation">skip</span></a> <a class="idref" href="Hoare2.html#96a08d9d8c7f327acf2f44c46454fe1a"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare2.html#96a08d9d8c7f327acf2f44c46454fe1a"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/>
</div>
</div>

<div class="doc">
Recall that you can <span class="inlinecode"><span class="id" title="keyword">Set</span></span> <span class="inlinecode"><span class="id" title="keyword">Printing</span></span> <span class="inlinecode"><span class="id" title="keyword">All</span></span> to see how all that
    notation is desugared. 
</div>
<div class="code">
<span class="id" title="keyword">Set Printing All</span>.<br/>
<span class="id" title="keyword">Print</span> <a class="idref" href="Hoare2.html#dec1"><span class="id" title="definition">dec1</span></a>.<br/>
<span class="id" title="keyword">Unset Printing All</span>.<br/>
</div>

<div class="doc">
An example <span class="inlinecode"><span class="id" title="var">decorated</span></span> program that decrements <span class="inlinecode"><span class="id" title="var">X</span></span> to <span class="inlinecode">0</span>: 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="dec_while" class="idref" href="#dec_while"><span class="id" title="definition">dec_while</span></a> : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> <span class="id" title="notation">¬</span><span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 0<span class="id" title="notation">)</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;&gt;'_x"><span class="id" title="notation">≠</span></a> 0<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a>  <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0 <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/>
</div>

<div class="doc">
It is easy to go from a <span class="inlinecode"><span class="id" title="var">dcom</span></span> to a <span class="inlinecode"><span class="id" title="var">com</span></span> by erasing all
    annotations. 
</div>
<div class="code">

<span class="id" title="keyword">Fixpoint</span> <a id="extract" class="idref" href="#extract"><span class="id" title="definition">extract</span></a> (<a id="d:41" class="idref" href="#d:41"><span class="id" title="binder">d</span></a> : <a class="idref" href="Hoare2.html#dcom"><span class="id" title="inductive">dcom</span></a>) : <span class="id" title="inductive">com</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <a class="idref" href="Hoare2.html#d:41"><span class="id" title="variable">d</span></a> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCSkip"><span class="id" title="constructor">DCSkip</span></a> <span class="id" title="var">_</span>           ⇒ <span class="id" title="constructor">CSkip</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCSeq"><span class="id" title="constructor">DCSeq</span></a> <span class="id" title="var">d<sub>1</sub></span> <span class="id" title="var">d<sub>2</sub></span>        ⇒ <span class="id" title="constructor">CSeq</span> (<a class="idref" href="Hoare2.html#extract:42"><span class="id" title="definition">extract</span></a> <span class="id" title="var">d<sub>1</sub></span>) (<a class="idref" href="Hoare2.html#extract:42"><span class="id" title="definition">extract</span></a> <span class="id" title="var">d<sub>2</sub></span>)<br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCAsgn"><span class="id" title="constructor">DCAsgn</span></a> <span class="id" title="var">X</span> <span class="id" title="var">a</span> <span class="id" title="var">_</span>       ⇒ <span class="id" title="constructor">CAsgn</span> <span class="id" title="var">X</span> <span class="id" title="var">a</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCIf"><span class="id" title="constructor">DCIf</span></a> <span class="id" title="var">b</span> <span class="id" title="var">_</span> <span class="id" title="var">d<sub>1</sub></span> <span class="id" title="var">_</span> <span class="id" title="var">d<sub>2</sub></span> <span class="id" title="var">_</span> ⇒ <span class="id" title="constructor">CIf</span> <span class="id" title="var">b</span> (<a class="idref" href="Hoare2.html#extract:42"><span class="id" title="definition">extract</span></a> <span class="id" title="var">d<sub>1</sub></span>) (<a class="idref" href="Hoare2.html#extract:42"><span class="id" title="definition">extract</span></a> <span class="id" title="var">d<sub>2</sub></span>)<br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCWhile"><span class="id" title="constructor">DCWhile</span></a> <span class="id" title="var">b</span> <span class="id" title="var">_</span> <span class="id" title="var">d</span> <span class="id" title="var">_</span>    ⇒ <span class="id" title="constructor">CWhile</span> <span class="id" title="var">b</span> (<a class="idref" href="Hoare2.html#extract:42"><span class="id" title="definition">extract</span></a> <a class="idref" href="Hoare2.html#d:41"><span class="id" title="variable">d</span></a>)<br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCPre"><span class="id" title="constructor">DCPre</span></a> <span class="id" title="var">_</span> <span class="id" title="var">d</span>          ⇒ <a class="idref" href="Hoare2.html#extract:42"><span class="id" title="definition">extract</span></a> <a class="idref" href="Hoare2.html#d:41"><span class="id" title="variable">d</span></a><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCPost"><span class="id" title="constructor">DCPost</span></a> <span class="id" title="var">d</span> <span class="id" title="var">_</span>         ⇒ <a class="idref" href="Hoare2.html#extract:42"><span class="id" title="definition">extract</span></a> <a class="idref" href="Hoare2.html#d:41"><span class="id" title="variable">d</span></a><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="extract_dec" class="idref" href="#extract_dec"><span class="id" title="definition">extract_dec</span></a> (<a id="dec:44" class="idref" href="#dec:44"><span class="id" title="binder">dec</span></a> : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a>) : <span class="id" title="inductive">com</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <a class="idref" href="Hoare2.html#dec:44"><span class="id" title="variable">dec</span></a> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#Decorated"><span class="id" title="constructor">Decorated</span></a> <span class="id" title="var">P</span> <span class="id" title="var">d</span> ⇒ <a class="idref" href="Hoare2.html#extract"><span class="id" title="definition">extract</span></a> <span class="id" title="var">d</span><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="extract_while_ex" class="idref" href="#extract_while_ex"><span class="id" title="definition">extract_while_ex</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#extract_dec"><span class="id" title="definition">extract_dec</span></a> <a class="idref" href="Hoare2.html#dec_while"><span class="id" title="definition">dec_while</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">&lt;{</span><span class="id" title="notation">while</span> <span class="id" title="notation">¬</span> <span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 0 <span class="id" title="notation">do</span> <span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> 1 <span class="id" title="notation">end</span><span class="id" title="notation">}&gt;</span>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare2.html#dec_while"><span class="id" title="definition">dec_while</span></a>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">reflexivity</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
It is straightforward to extract the precondition and
    postcondition from a decorated program. 
</div>
<div class="code">

<span class="id" title="keyword">Fixpoint</span> <a id="post" class="idref" href="#post"><span class="id" title="definition">post</span></a> (<a id="d:46" class="idref" href="#d:46"><span class="id" title="binder">d</span></a> : <a class="idref" href="Hoare2.html#dcom"><span class="id" title="inductive">dcom</span></a>) : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <a class="idref" href="Hoare2.html#d:46"><span class="id" title="variable">d</span></a> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCSkip"><span class="id" title="constructor">DCSkip</span></a> <span class="id" title="var">P</span>                ⇒ <span class="id" title="var">P</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCSeq"><span class="id" title="constructor">DCSeq</span></a> <span class="id" title="var">_</span> <span class="id" title="var">d<sub>2</sub></span>              ⇒ <a class="idref" href="Hoare2.html#post:47"><span class="id" title="definition">post</span></a> <span class="id" title="var">d<sub>2</sub></span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCAsgn"><span class="id" title="constructor">DCAsgn</span></a> <span class="id" title="var">_</span> <span class="id" title="var">_</span> <span class="id" title="var">Q</span>            ⇒ <span class="id" title="var">Q</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCIf"><span class="id" title="constructor">DCIf</span></a>  <span class="id" title="var">_</span> <span class="id" title="var">_</span> <span class="id" title="var">_</span> <span class="id" title="var">_</span> <span class="id" title="var">_</span> <span class="id" title="var">Q</span>       ⇒ <span class="id" title="var">Q</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCWhile"><span class="id" title="constructor">DCWhile</span></a> <span class="id" title="var">_</span> <span class="id" title="var">_</span> <span class="id" title="var">_</span> <span class="id" title="var">Q</span>         ⇒ <span class="id" title="var">Q</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCPre"><span class="id" title="constructor">DCPre</span></a> <span class="id" title="var">_</span> <span class="id" title="var">d</span>               ⇒ <a class="idref" href="Hoare2.html#post:47"><span class="id" title="definition">post</span></a> <a class="idref" href="Hoare2.html#d:46"><span class="id" title="variable">d</span></a><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCPost"><span class="id" title="constructor">DCPost</span></a> <span class="id" title="var">_</span> <span class="id" title="var">Q</span>              ⇒ <span class="id" title="var">Q</span><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="pre_dec" class="idref" href="#pre_dec"><span class="id" title="definition">pre_dec</span></a> (<a id="dec:49" class="idref" href="#dec:49"><span class="id" title="binder">dec</span></a> : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a>) : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <a class="idref" href="Hoare2.html#dec:49"><span class="id" title="variable">dec</span></a> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#Decorated"><span class="id" title="constructor">Decorated</span></a> <span class="id" title="var">P</span> <span class="id" title="var">d</span> ⇒ <span class="id" title="var">P</span><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="post_dec" class="idref" href="#post_dec"><span class="id" title="definition">post_dec</span></a> (<a id="dec:51" class="idref" href="#dec:51"><span class="id" title="binder">dec</span></a> : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a>) : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <a class="idref" href="Hoare2.html#dec:51"><span class="id" title="variable">dec</span></a> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#Decorated"><span class="id" title="constructor">Decorated</span></a> <span class="id" title="var">P</span> <span class="id" title="var">d</span> ⇒ <a class="idref" href="Hoare2.html#post"><span class="id" title="definition">post</span></a> <span class="id" title="var">d</span><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="pre_dec_while" class="idref" href="#pre_dec_while"><span class="id" title="definition">pre_dec_while</span></a> : <a class="idref" href="Hoare2.html#pre_dec"><span class="id" title="definition">pre_dec</span></a> <a class="idref" href="Hoare2.html#dec_while"><span class="id" title="definition">dec_while</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">reflexivity</span>. <span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="post_dec_while" class="idref" href="#post_dec_while"><span class="id" title="definition">post_dec_while</span></a> : <a class="idref" href="Hoare2.html#post_dec"><span class="id" title="definition">post_dec</span></a> <a class="idref" href="Hoare2.html#dec_while"><span class="id" title="definition">dec_while</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0)%<span class="id" title="var">assertion</span>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">reflexivity</span>. <span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
We can express what it means for a decorated program to be
    correct as follows: 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="dec_correct" class="idref" href="#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a id="dec:53" class="idref" href="#dec:53"><span class="id" title="binder">dec</span></a> : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a>) :=<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare2.html#pre_dec"><span class="id" title="definition">pre_dec</span></a> <a class="idref" href="Hoare2.html#dec:53"><span class="id" title="variable">dec</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#extract_dec"><span class="id" title="definition">extract_dec</span></a> <a class="idref" href="Hoare2.html#dec:53"><span class="id" title="variable">dec</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare2.html#post_dec"><span class="id" title="definition">post_dec</span></a> <a class="idref" href="Hoare2.html#dec:53"><span class="id" title="variable">dec</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="dec_while_triple_correct" class="idref" href="#dec_while_triple_correct"><span class="id" title="definition">dec_while_triple_correct</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> <a class="idref" href="Hoare2.html#dec_while"><span class="id" title="definition">dec_while</span></a><br/>
&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;<span class="id" title="notation">while</span> <span class="id" title="notation">¬</span><span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 0<span class="id" title="notation">)</span> <span class="id" title="notation">do</span> <span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> 1 <span class="id" title="notation">end</span><br/>
&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">reflexivity</span>. <span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
To check whether this Hoare triple is <i>valid</i>, we need a way to
    extract the "proof obligations" from a decorated program. These
    obligations are often called <i>verification conditions</i>, because
    they are the facts that must be verified to see that the
    decorations are logically consistent and thus constitute a proof
    of correctness. 
<div class="paragraph"> </div>

<a id="lab123"></a><h2 class="section">Extracting Verification Conditions</h2>

<div class="paragraph"> </div>

 The function <span class="inlinecode"><span class="id" title="var">verification_conditions</span></span> takes a <span class="inlinecode"><span class="id" title="var">dcom</span></span> <span class="inlinecode"><span class="id" title="var">d</span></span> together
    with a precondition <span class="inlinecode"><span class="id" title="var">P</span></span> and returns a <i>proposition</i> that, if it
    can be proved, implies that the triple <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode">(<span class="id" title="var">extract</span></span> <span class="inlinecode"><span class="id" title="var">d</span>)</span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">post</span></span> <span class="inlinecode"><span class="id" title="var">d</span><span style='letter-spacing:-.4em;'>}</span>}</span>
    is valid. It does this by walking over <span class="inlinecode"><span class="id" title="var">d</span></span> and generating a big
    conjunction that includes

<div class="paragraph"> </div>

<ul class="doclist">
<li> all the local consistency checks, plus

<div class="paragraph"> </div>


</li>
<li> many uses of <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> to bridge the gap between (i) assertions
      found inside decorated commands and (ii) assertions used by the
      local consistency checks.  These uses correspond applications of
      the consequence rule. 

</li>
</ul>
</div>
<div class="code">

<span class="id" title="keyword">Fixpoint</span> <a id="verification_conditions" class="idref" href="#verification_conditions"><span class="id" title="definition">verification_conditions</span></a> (<a id="P:54" class="idref" href="#P:54"><span class="id" title="binder">P</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="d:55" class="idref" href="#d:55"><span class="id" title="binder">d</span></a> : <a class="idref" href="Hoare2.html#dcom"><span class="id" title="inductive">dcom</span></a>) : <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <a class="idref" href="Hoare2.html#d:55"><span class="id" title="variable">d</span></a> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCSkip"><span class="id" title="constructor">DCSkip</span></a> <span class="id" title="var">Q</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare2.html#P:54"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">Q</span>)<br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCSeq"><span class="id" title="constructor">DCSeq</span></a> <span class="id" title="var">d<sub>1</sub></span> <span class="id" title="var">d<sub>2</sub></span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#verification_conditions:56"><span class="id" title="definition">verification_conditions</span></a> <a class="idref" href="Hoare2.html#P:54"><span class="id" title="variable">P</span></a> <span class="id" title="var">d<sub>1</sub></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare2.html#verification_conditions:56"><span class="id" title="definition">verification_conditions</span></a> (<a class="idref" href="Hoare2.html#post"><span class="id" title="definition">post</span></a> <span class="id" title="var">d<sub>1</sub></span>) <span class="id" title="var">d<sub>2</sub></span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCAsgn"><span class="id" title="constructor">DCAsgn</span></a> <span class="id" title="var">X</span> <span class="id" title="var">a</span> <span class="id" title="var">Q</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare2.html#P:54"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">Q</span> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">[</span></a><span class="id" title="var">X</span> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span></a> <span class="id" title="var">a</span><a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">]</span></a>)<br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCIf"><span class="id" title="constructor">DCIf</span></a> <span class="id" title="var">b</span> <span class="id" title="var">P<sub>1</sub></span> <span class="id" title="var">d<sub>1</sub></span> <span class="id" title="var">P<sub>2</sub></span> <span class="id" title="var">d<sub>2</sub></span> <span class="id" title="var">Q</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#P:54"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="var">b</span><a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">P<sub>1</sub></span>)%<span class="id" title="var">assertion</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> (<a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#P:54"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">¬</span></a> <span class="id" title="var">b</span><a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">P<sub>2</sub></span>)%<span class="id" title="var">assertion</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#post"><span class="id" title="definition">post</span></a> <span class="id" title="var">d<sub>1</sub></span> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">Q</span><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">)</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#post"><span class="id" title="definition">post</span></a> <span class="id" title="var">d<sub>2</sub></span> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">Q</span><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare2.html#verification_conditions:56"><span class="id" title="definition">verification_conditions</span></a> <span class="id" title="var">P<sub>1</sub></span> <span class="id" title="var">d<sub>1</sub></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare2.html#verification_conditions:56"><span class="id" title="definition">verification_conditions</span></a> <span class="id" title="var">P<sub>2</sub></span> <span class="id" title="var">d<sub>2</sub></span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCWhile"><span class="id" title="constructor">DCWhile</span></a> <span class="id" title="var">b</span> <span class="id" title="var">Pbody</span> <span class="id" title="var">d</span> <span class="id" title="var">Ppost</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;post&nbsp;d&nbsp;is&nbsp;the&nbsp;loop&nbsp;invariant&nbsp;and&nbsp;the&nbsp;initial<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;precondition&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#P:54"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare2.html#post"><span class="id" title="definition">post</span></a> <a class="idref" href="Hoare2.html#d:55"><span class="id" title="variable">d</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> (<a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#post"><span class="id" title="definition">post</span></a> <a class="idref" href="Hoare2.html#d:55"><span class="id" title="variable">d</span></a>  <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="var">b</span><a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">Pbody</span>)%<span class="id" title="var">assertion</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> (<a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#post"><span class="id" title="definition">post</span></a> <a class="idref" href="Hoare2.html#d:55"><span class="id" title="variable">d</span></a>  <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">¬</span></a> <span class="id" title="var">b</span><a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">Ppost</span>)%<span class="id" title="var">assertion</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare2.html#verification_conditions:56"><span class="id" title="definition">verification_conditions</span></a> <span class="id" title="var">Pbody</span> <a class="idref" href="Hoare2.html#d:55"><span class="id" title="variable">d</span></a><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCPre"><span class="id" title="constructor">DCPre</span></a> <span class="id" title="var">P'</span> <span class="id" title="var">d</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#P:54"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">P'</span><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">)</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare2.html#verification_conditions:56"><span class="id" title="definition">verification_conditions</span></a> <span class="id" title="var">P'</span> <a class="idref" href="Hoare2.html#d:55"><span class="id" title="variable">d</span></a><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#DCPost"><span class="id" title="constructor">DCPost</span></a> <span class="id" title="var">d</span> <span class="id" title="var">Q</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#verification_conditions:56"><span class="id" title="definition">verification_conditions</span></a> <a class="idref" href="Hoare2.html#P:54"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare2.html#d:55"><span class="id" title="variable">d</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#post"><span class="id" title="definition">post</span></a> <a class="idref" href="Hoare2.html#d:55"><span class="id" title="variable">d</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">Q</span><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.<br/>
</div>

<div class="doc">
And now the key theorem, stating that <span class="inlinecode"><span class="id" title="var">verification_conditions</span></span>
    does its job correctly.  Not surprisingly, we need to use each of
    the Hoare Logic rules at some point in the proof. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="verification_correct" class="idref" href="#verification_correct"><span class="id" title="lemma">verification_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="d:58" class="idref" href="#d:58"><span class="id" title="binder">d</span></a> <a id="P:59" class="idref" href="#P:59"><span class="id" title="binder">P</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#verification_conditions"><span class="id" title="definition">verification_conditions</span></a> <a class="idref" href="Hoare2.html#P:59"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare2.html#d:58"><span class="id" title="variable">d</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare2.html#P:59"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#extract"><span class="id" title="definition">extract</span></a> <a class="idref" href="Hoare2.html#d:58"><span class="id" title="variable">d</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare2.html#post"><span class="id" title="definition">post</span></a> <a class="idref" href="Hoare2.html#d:58"><span class="id" title="variable">d</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol5" onclick="toggleDisplay('proof5');toggleDisplay('proofcontrol5')"><span class="show"></span></div>
<div class="proofscript" id="proof5" onclick="toggleDisplay('proof5');toggleDisplay('proofcontrol5')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">induction</span> <span class="id" title="var">d</span>; <span class="id" title="tactic">intros</span>; <span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> ×.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Skip&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_skip"><span class="id" title="lemma">hoare_skip</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Seq&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> <span class="id" title="var">H</span> <span class="id" title="keyword">as</span> [<span class="id" title="var">H<sub>1</sub></span> <span class="id" title="var">H<sub>2</sub></span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_seq"><span class="id" title="lemma">hoare_seq</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <span class="id" title="var">IHd2</span>. <span class="id" title="tactic">apply</span> <span class="id" title="var">H<sub>2</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <span class="id" title="var">IHd1</span>. <span class="id" title="tactic">apply</span> <span class="id" title="var">H<sub>1</sub></span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Asgn&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;If&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> <span class="id" title="var">H</span> <span class="id" title="keyword">as</span> [<span class="id" title="var">HPre1</span> [<span class="id" title="var">HPre2</span> [<span class="id" title="var">Hd<sub>1</sub></span> [<span class="id" title="var">Hd<sub>2</sub></span> [<span class="id" title="var">HThen</span> <span class="id" title="var">HElse</span>] ] ] ] ].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">IHd1</span> <span class="id" title="keyword">in</span> <span class="id" title="var">HThen</span>. <span class="id" title="tactic">clear</span> <span class="id" title="var">IHd1</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">IHd2</span> <span class="id" title="keyword">in</span> <span class="id" title="var">HElse</span>. <span class="id" title="tactic">clear</span> <span class="id" title="var">IHd2</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_if"><span class="id" title="lemma">hoare_if</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence"><span class="id" title="lemma">hoare_consequence</span></a>; <span class="id" title="tactic">eauto</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence"><span class="id" title="lemma">hoare_consequence</span></a>; <span class="id" title="tactic">eauto</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;While&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> <span class="id" title="var">H</span> <span class="id" title="keyword">as</span> [<span class="id" title="var">Hpre</span> [<span class="id" title="var">Hbody1</span> [<span class="id" title="var">Hpost1</span>  <span class="id" title="var">Hd</span>] ] ].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence"><span class="id" title="lemma">hoare_consequence</span></a>; <span class="id" title="tactic">eauto</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_while"><span class="id" title="lemma">hoare_while</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>; <span class="id" title="tactic">eauto</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Pre&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> <span class="id" title="var">H</span> <span class="id" title="keyword">as</span> [<span class="id" title="var">HP</span> <span class="id" title="var">Hd</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>; <span class="id" title="tactic">eauto</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Post&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> <span class="id" title="var">H</span> <span class="id" title="keyword">as</span> [<span class="id" title="var">Hd</span> <span class="id" title="var">HQ</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_post"><span class="id" title="lemma">hoare_consequence_post</span></a>; <span class="id" title="tactic">eauto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
Now that all the pieces are in place, we can verify an entire program. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="verification_conditions_dec" class="idref" href="#verification_conditions_dec"><span class="id" title="definition">verification_conditions_dec</span></a> (<a id="dec:60" class="idref" href="#dec:60"><span class="id" title="binder">dec</span></a> : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a>) : <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <a class="idref" href="Hoare2.html#dec:60"><span class="id" title="variable">dec</span></a> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| <a class="idref" href="Hoare2.html#Decorated"><span class="id" title="constructor">Decorated</span></a> <span class="id" title="var">P</span> <span class="id" title="var">d</span> ⇒ <a class="idref" href="Hoare2.html#verification_conditions"><span class="id" title="definition">verification_conditions</span></a> <span class="id" title="var">P</span> <span class="id" title="var">d</span><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Corollary</span> <a id="verification_correct_dec" class="idref" href="#verification_correct_dec"><span class="id" title="lemma">verification_correct_dec</span></a> : <span class="id" title="keyword">∀</span> <a id="dec:62" class="idref" href="#dec:62"><span class="id" title="binder">dec</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#verification_conditions_dec"><span class="id" title="definition">verification_conditions_dec</span></a> <a class="idref" href="Hoare2.html#dec:62"><span class="id" title="variable">dec</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> <a class="idref" href="Hoare2.html#dec:62"><span class="id" title="variable">dec</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> [<span class="id" title="var">P</span> <span class="id" title="var">d</span>]. <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare2.html#verification_correct"><span class="id" title="lemma">verification_correct</span></a>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
The propositions generated by <span class="inlinecode"><span class="id" title="var">verification_conditions</span></span> are fairly
    big, and they contain many conjuncts that are essentially trivial.
    Our <span class="inlinecode"><span class="id" title="var">verify_assn</span></span> can often take care of them. 
</div>
<div class="code">

<span class="id" title="keyword">Eval</span> <span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> <a class="idref" href="Hoare2.html#verification_conditions_dec"><span class="id" title="definition">verification_conditions_dec</span></a> <a class="idref" href="Hoare2.html#dec_while"><span class="id" title="definition">dec_while</span></a>.<br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;==&gt;<br/>
&nbsp;&nbsp;=&nbsp;&nbsp;(((fun&nbsp;_&nbsp;:&nbsp;state&nbsp;=&gt;&nbsp;True)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(fun&nbsp;_&nbsp;:&nbsp;state&nbsp;=&gt;&nbsp;True))&nbsp;/\<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;((fun&nbsp;st&nbsp;:&nbsp;state&nbsp;=&gt;&nbsp;True&nbsp;/\&nbsp;negb&nbsp;(st&nbsp;X&nbsp;=?&nbsp;0)&nbsp;=&nbsp;true)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(fun&nbsp;st&nbsp;:&nbsp;state&nbsp;=&gt;&nbsp;True&nbsp;/\&nbsp;st&nbsp;X&nbsp;&lt;&gt;&nbsp;0))&nbsp;/\<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;((fun&nbsp;st&nbsp;:&nbsp;state&nbsp;=&gt;&nbsp;True&nbsp;/\&nbsp;negb&nbsp;(st&nbsp;X&nbsp;=?&nbsp;0)&nbsp;&lt;&gt;&nbsp;true)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(fun&nbsp;st&nbsp;:&nbsp;state&nbsp;=&gt;&nbsp;True&nbsp;/\&nbsp;st&nbsp;X&nbsp;=&nbsp;0))&nbsp;/\<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(fun&nbsp;st&nbsp;:&nbsp;state&nbsp;=&gt;&nbsp;True&nbsp;/\&nbsp;st&nbsp;X&nbsp;&lt;&gt;&nbsp;0)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(fun&nbsp;_&nbsp;:&nbsp;state&nbsp;=&gt;&nbsp;True)&nbsp;<span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">-</span> <span class="inlinecode">1</span>)&nbsp;/\<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(fun&nbsp;st&nbsp;:&nbsp;state&nbsp;=&gt;&nbsp;True&nbsp;/\&nbsp;st&nbsp;X&nbsp;=&nbsp;0)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(fun&nbsp;st&nbsp;:&nbsp;state&nbsp;=&gt;&nbsp;st&nbsp;X&nbsp;=&nbsp;0)<br/>
&nbsp;&nbsp;&nbsp;:&nbsp;Prop<br/>
<br/>
*)</span><br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="vc_dec_while" class="idref" href="#vc_dec_while"><span class="id" title="definition">vc_dec_while</span></a> : <a class="idref" href="Hoare2.html#verification_conditions_dec"><span class="id" title="definition">verification_conditions_dec</span></a> <a class="idref" href="Hoare2.html#dec_while"><span class="id" title="definition">dec_while</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="var">verify_assn</span>. <span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a id="lab124"></a><h2 class="section">Automation</h2>

<div class="paragraph"> </div>

 To automate the entire process of verification, we can use
    <span class="inlinecode"><span class="id" title="var">verification_correct</span></span> to extract the verification conditions,
    then use <span class="inlinecode"><span class="id" title="var">verify_assn</span></span> to verify them (if it can).  
</div>
<div class="code">
<span class="id" title="keyword">Ltac</span> <span class="id" title="var">verify</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span>;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare2.html#verification_correct"><span class="id" title="lemma">verification_correct</span></a>;<br/>
&nbsp;&nbsp;<span class="id" title="var">verify_assn</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="Dec_while_correct" class="idref" href="#Dec_while_correct"><span class="id" title="lemma">Dec_while_correct</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> <a class="idref" href="Hoare2.html#dec_while"><span class="id" title="definition">dec_while</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="var">verify</span>. <span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Let's use all this automation to verify formal decorated programs
    corresponding to some of the informal ones we have seen. 
<div class="paragraph"> </div>

<a id="lab125"></a><h3 class="section">Slow Subtraction</h3>

</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="subtract_slowly_dec" class="idref" href="#subtract_slowly_dec"><span class="id" title="definition">subtract_slowly_dec</span></a> (<a id="m:63" class="idref" href="#m:63"><span class="id" title="binder">m</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) (<a id="p:64" class="idref" href="#p:64"><span class="id" title="binder">p</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:63"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a>  <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#p:64"><span class="id" title="variable">p</span></a> <a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#p:64"><span class="id" title="variable">p</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#m:63"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> <span class="id" title="notation">¬</span><span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 0<span class="id" title="notation">)</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a>   <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#p:64"><span class="id" title="variable">p</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#m:63"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span>  <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;&gt;'_x"><span class="id" title="notation">≠</span></a>  0 <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#p:64"><span class="id" title="variable">p</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#m:63"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Z</span> <span class="id" title="notation">-</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#p:64"><span class="id" title="variable">p</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#m:63"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#p:64"><span class="id" title="variable">p</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#m:63"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#p:64"><span class="id" title="variable">p</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#m:63"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0 <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#p:64"><span class="id" title="variable">p</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#m:63"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="subtract_slowly_dec_correct" class="idref" href="#subtract_slowly_dec_correct"><span class="id" title="lemma">subtract_slowly_dec_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="m:65" class="idref" href="#m:65"><span class="id" title="binder">m</span></a> <a id="p:66" class="idref" href="#p:66"><span class="id" title="binder">p</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#subtract_slowly_dec"><span class="id" title="definition">subtract_slowly_dec</span></a> <a class="idref" href="Hoare2.html#m:65"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#p:66"><span class="id" title="variable">p</span></a>).<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="var">verify</span>. <span class="comment">(*&nbsp;this&nbsp;grinds&nbsp;for&nbsp;a&nbsp;bit!&nbsp;*)</span> <span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a id="lab126"></a><h3 class="section">Swapping Using Addition and Subtraction</h3>

</div>
<div class="code">

<span class="comment">(*&nbsp;Definition&nbsp;swap&nbsp;:&nbsp;com&nbsp;:=&nbsp;*)</span><br/>
<span class="comment">(*&nbsp;&nbsp;&nbsp;&lt;{&nbsp;X&nbsp;:=&nbsp;X&nbsp;+&nbsp;Y;&nbsp;*)</span><br/>
<span class="comment">(*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;:=&nbsp;X&nbsp;-&nbsp;Y;&nbsp;*)</span><br/>
<span class="comment">(*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X&nbsp;:=&nbsp;X&nbsp;-&nbsp;Y&nbsp;}&gt;.&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="swap_dec" class="idref" href="#swap_dec"><span class="id" title="definition">swap_dec</span></a> (<a id="m:67" class="idref" href="#m:67"><span class="id" title="binder">m</span></a> <a id="n:68" class="idref" href="#n:68"><span class="id" title="binder">n</span></a>:<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:67"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:68"><span class="id" title="variable">n</span></a><a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">((</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:68"><span class="id" title="variable">n</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:67"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> <span class="id" title="definition">Y</span><br/>
&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:68"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:67"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> <span class="id" title="definition">Y</span><br/>
&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:68"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:67"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> <span class="id" title="definition">Y</span><br/>
&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:68"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:67"><span class="id" title="variable">m</span></a><a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="swap_correct" class="idref" href="#swap_correct"><span class="id" title="lemma">swap_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="m:69" class="idref" href="#m:69"><span class="id" title="binder">m</span></a> <a id="n:70" class="idref" href="#n:70"><span class="id" title="binder">n</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#swap_dec"><span class="id" title="definition">swap_dec</span></a> <a class="idref" href="Hoare2.html#m:69"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#n:70"><span class="id" title="variable">n</span></a>).<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="var">verify</span>. <span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a id="lab127"></a><h3 class="section">Division</h3>

</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="div_mod_dec" class="idref" href="#div_mod_dec"><span class="id" title="definition">div_mod_dec</span></a> (<a id="a:71" class="idref" href="#a:71"><span class="id" title="binder">a</span></a> <a id="b:72" class="idref" href="#b:72"><span class="id" title="binder">b</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> 0 <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> 0 <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> 0<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <span class="id" title="notation">≤</span> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a><a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Y</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">~(</span></a><a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#a:71"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> <a class="idref" href="Hoare2.html#b:72"><span class="id" title="variable">b</span></a><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="div_mod_dec_correct" class="idref" href="#div_mod_dec_correct"><span class="id" title="lemma">div_mod_dec_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="a:73" class="idref" href="#a:73"><span class="id" title="binder">a</span></a> <a id="b:74" class="idref" href="#b:74"><span class="id" title="binder">b</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#div_mod_dec"><span class="id" title="definition">div_mod_dec</span></a> <a class="idref" href="Hoare2.html#a:73"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare2.html#b:74"><span class="id" title="variable">b</span></a>).<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="var">verify</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a id="lab128"></a><h3 class="section">Parity</h3>

</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="find_parity" class="idref" href="#find_parity"><span class="id" title="definition">find_parity</span></a> : <span class="id" title="inductive">com</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span> <span class="id" title="notation">while</span> 2 <span class="id" title="notation">≤</span> <span class="id" title="definition">X</span> <span class="id" title="notation">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="notation">end</span> <span class="id" title="notation">}&gt;</span>.<br/>
</div>

<div class="doc">
There are actually several ways to phrase the loop invariant for
    this program.  Here is one natural one, which leads to a rather
    long proof: 
</div>
<div class="code">

<span class="id" title="keyword">Inductive</span> <a id="ev" class="idref" href="#ev"><span class="id" title="inductive">ev</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;| <a id="ev_0" class="idref" href="#ev_0"><span class="id" title="constructor">ev_0</span></a> : <a class="idref" href="Hoare2.html#ev:75"><span class="id" title="inductive">ev</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#O"><span class="id" title="constructor">O</span></a><br/>
&nbsp;&nbsp;| <a id="ev_SS" class="idref" href="#ev_SS"><span class="id" title="constructor">ev_SS</span></a> : <span class="id" title="keyword">∀</span> <a id="n:77" class="idref" href="#n:77"><span class="id" title="binder">n</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>, <a class="idref" href="Hoare2.html#ev:75"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#n:77"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare2.html#ev:75"><span class="id" title="inductive">ev</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> <a class="idref" href="Hoare2.html#n:77"><span class="id" title="variable">n</span></a>)).<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="find_parity_dec" class="idref" href="#find_parity_dec"><span class="id" title="definition">find_parity_dec</span></a> (<a id="m:78" class="idref" href="#m:78"><span class="id" title="binder">m</span></a>:<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> (<a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">X</span>) <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> 2 <span class="id" title="notation">≤</span> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> (<a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">X</span>)<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> 2 <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 2 <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> (<a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 2<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)</span></a>) <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> (<a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">X</span>) <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> (<a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">X</span>)<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> 2 <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a>  <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0 <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;-&gt;'_x"><span class="id" title="notation">↔</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:78"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Lemma</span> <a id="l<sub>1</sub>" class="idref" href="#l<sub>1</sub>"><span class="id" title="lemma">l<sub>1</sub></span></a> : <span class="id" title="keyword">∀</span> <a id="m:79" class="idref" href="#m:79"><span class="id" title="binder">m</span></a> <a id="n:80" class="idref" href="#n:80"><span class="id" title="binder">n</span></a> <a id="p:81" class="idref" href="#p:81"><span class="id" title="binder">p</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#p:81"><span class="id" title="variable">p</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#n:80"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#n:80"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:79"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#m:79"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#n:80"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#p:81"><span class="id" title="variable">p</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:79"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#n:80"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare2.html#p:81"><span class="id" title="variable">p</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">intros</span>. <span class="id" title="var">lia</span>. <span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Lemma</span> <a id="l<sub>2</sub>" class="idref" href="#l<sub>2</sub>"><span class="id" title="lemma">l<sub>2</sub></span></a> : <span class="id" title="keyword">∀</span> <a id="m:82" class="idref" href="#m:82"><span class="id" title="binder">m</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:82"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> (<a class="idref" href="Hoare2.html#m:82"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 2).<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">intros</span>. <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.add_comm"><span class="id" title="lemma">add_comm</span></a>. <span class="id" title="tactic">simpl</span>. <span class="id" title="tactic">constructor</span>. <span class="id" title="tactic">assumption</span>. <span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Lemma</span> <a id="l<sub>3</sub>'" class="idref" href="#l<sub>3</sub>'"><span class="id" title="lemma">l<sub>3</sub>'</span></a> : <span class="id" title="keyword">∀</span> <a id="m:83" class="idref" href="#m:83"><span class="id" title="binder">m</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:83"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">¬</span></a><a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> <a class="idref" href="Hoare2.html#m:83"><span class="id" title="variable">m</span></a>).<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">induction</span> <span class="id" title="var">m</span>; <span class="id" title="tactic">intros</span> <span class="id" title="var">H<sub>1</sub></span> <span class="id" title="var">H<sub>2</sub></span>. <span class="id" title="tactic">inversion</span> <span class="id" title="var">H<sub>2</sub></span>. <span class="id" title="tactic">apply</span> <span class="id" title="var">IHm</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">H<sub>2</sub></span>; <span class="id" title="tactic">subst</span>; <span class="id" title="tactic">assumption</span>. <span class="id" title="tactic">assumption</span>. <span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Lemma</span> <a id="l<sub>3</sub>" class="idref" href="#l<sub>3</sub>"><span class="id" title="lemma">l<sub>3</sub></span></a> : <span class="id" title="keyword">∀</span> <a id="m:84" class="idref" href="#m:84"><span class="id" title="binder">m</span></a>,<br/>
&nbsp;&nbsp;1 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:84"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:84"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> (<a class="idref" href="Hoare2.html#m:84"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1) <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#False"><span class="id" title="inductive">False</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">intros</span>. <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare2.html#l<sub>2</sub>"><span class="id" title="lemma">l<sub>2</sub></span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">H<sub>1</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">assert</span> (<span class="id" title="var">G</span> : <span class="id" title="var">m</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 2 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> <span class="id" title="var">m</span>). <span class="id" title="tactic">clear</span> <span class="id" title="var">H<sub>0</sub></span> <span class="id" title="var">H<sub>1</sub></span>. <span class="id" title="var">lia</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <span class="id" title="var">G</span> <span class="id" title="keyword">in</span> <span class="id" title="var">H<sub>1</sub></span>. <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare2.html#l<sub>3</sub>'"><span class="id" title="lemma">l<sub>3</sub>'</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">H<sub>0</sub></span>. <span class="id" title="tactic">apply</span> <span class="id" title="var">H<sub>0</sub></span>. <span class="id" title="tactic">assumption</span>. <span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="find_parity_correct" class="idref" href="#find_parity_correct"><span class="id" title="lemma">find_parity_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="m:85" class="idref" href="#m:85"><span class="id" title="binder">m</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#find_parity_dec"><span class="id" title="definition">find_parity_dec</span></a> <a class="idref" href="Hoare2.html#m:85"><span class="id" title="variable">m</span></a>).<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="var">verify</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;simplification&nbsp;too&nbsp;aggressive&nbsp;...&nbsp;reverting&nbsp;a&nbsp;bit&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">fold</span> (2 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0f31f5c1c6b6a21a3a187247222bc9e<sub>4</sub>"><span class="id" title="notation">&lt;=?</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0f31f5c1c6b6a21a3a187247222bc9e<sub>4</sub>"><span class="id" title="notation">(</span></a><span class="id" title="var">st</span> <span class="id" title="definition">X</span><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0f31f5c1c6b6a21a3a187247222bc9e<sub>4</sub>"><span class="id" title="notation">)</span></a>) <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Compare_dec.html#leb_iff"><span class="id" title="abbreviation">leb_iff</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Compare_dec.html#leb_iff_conv"><span class="id" title="lemma">leb_iff_conv</span></a> <span class="id" title="keyword">in</span> *; <span class="id" title="tactic">eauto</span>; <span class="id" title="tactic">try</span> <span class="id" title="var">lia</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;holds&nbsp;initially&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Minus.html#minus_diag"><span class="id" title="abbreviation">minus_diag</span></a>. <span class="id" title="tactic">constructor</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <a class="idref" href="Hoare2.html#l<sub>1</sub>"><span class="id" title="lemma">l<sub>1</sub></span></a>; <span class="id" title="tactic">try</span> <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare2.html#l<sub>2</sub>"><span class="id" title="lemma">l<sub>2</sub></span></a>; <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;strong&nbsp;enough&nbsp;to&nbsp;imply&nbsp;conclusion<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;direction)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> &lt;- <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Minus.html#minus_n_O"><span class="id" title="lemma">minus_n_O</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">H<sub>2</sub></span>. <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;strong&nbsp;enough&nbsp;to&nbsp;imply&nbsp;conclusion<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(&lt;-&nbsp;direction)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> (<span class="id" title="var">st</span> <span class="id" title="definition">X</span>) <span class="id" title="keyword">as</span> [| [| <span class="id" title="var">n</span>] ].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;by&nbsp;H<sub>1</sub>&nbsp;X&nbsp;can&nbsp;only&nbsp;be&nbsp;0&nbsp;or&nbsp;1&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;0&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;1&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare2.html#l<sub>3</sub>"><span class="id" title="lemma">l<sub>3</sub></span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">H</span>; <span class="id" title="tactic">try</span> <span class="id" title="tactic">assumption</span>. <span class="id" title="tactic">inversion</span> <span class="id" title="var">H</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;2&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">lia</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Here is a more intuitive way of writing the invariant: 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="find_parity_dec'" class="idref" href="#find_parity_dec'"><span class="id" title="definition">find_parity_dec'</span></a> (<a id="m:86" class="idref" href="#m:86"><span class="id" title="binder">m</span></a>:<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:86"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;-&gt;'_x"><span class="id" title="notation">↔</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:86"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> 2 <span class="id" title="notation">≤</span> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;-&gt;'_x"><span class="id" title="notation">↔</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:86"><span class="id" title="variable">m</span></a><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> 2 <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 2) <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;-&gt;'_x"><span class="id" title="notation">↔</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:86"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">-</span> 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;-&gt;'_x"><span class="id" title="notation">↔</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:86"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;-&gt;'_x"><span class="id" title="notation">↔</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:86"><span class="id" title="variable">m</span></a><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">~(</span></a>2 <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a>  <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a>0 <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;-&gt;'_x"><span class="id" title="notation">↔</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:86"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Lemma</span> <a id="l<sub>4</sub>" class="idref" href="#l<sub>4</sub>"><span class="id" title="lemma">l<sub>4</sub></span></a> : <span class="id" title="keyword">∀</span> <a id="m:87" class="idref" href="#m:87"><span class="id" title="binder">m</span></a>,<br/>
&nbsp;&nbsp;2 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:87"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> (<a class="idref" href="Hoare2.html#m:87"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 2) <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'&lt;-&gt;'_x"><span class="id" title="notation">↔</span></a> <a class="idref" href="Hoare2.html#ev"><span class="id" title="inductive">ev</span></a> <a class="idref" href="Hoare2.html#m:87"><span class="id" title="variable">m</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">)</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">induction</span> <span class="id" title="var">m</span>; <span class="id" title="tactic">intros</span>. <span class="id" title="tactic">split</span>; <span class="id" title="tactic">intro</span>; <span class="id" title="tactic">constructor</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> <span class="id" title="var">m</span>. <span class="id" title="tactic">inversion</span> <span class="id" title="var">H</span>. <span class="id" title="tactic">inversion</span> <span class="id" title="var">H<sub>1</sub></span>. <span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> ×.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> &lt;- <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Minus.html#minus_n_O"><span class="id" title="lemma">minus_n_O</span></a> <span class="id" title="keyword">in</span> ×. <span class="id" title="tactic">split</span>; <span class="id" title="tactic">intro</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">constructor</span>. <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">H<sub>0</sub></span>. <span class="id" title="tactic">assumption</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="find_parity_correct'" class="idref" href="#find_parity_correct'"><span class="id" title="lemma">find_parity_correct'</span></a> : <span class="id" title="keyword">∀</span> <a id="m:88" class="idref" href="#m:88"><span class="id" title="binder">m</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#find_parity_dec'"><span class="id" title="definition">find_parity_dec'</span></a> <a class="idref" href="Hoare2.html#m:88"><span class="id" title="variable">m</span></a>).<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="var">verify</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;simplification&nbsp;too&nbsp;aggressive&nbsp;...&nbsp;reverting&nbsp;a&nbsp;bit&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">fold</span> (2 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0f31f5c1c6b6a21a3a187247222bc9e<sub>4</sub>"><span class="id" title="notation">&lt;=?</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0f31f5c1c6b6a21a3a187247222bc9e<sub>4</sub>"><span class="id" title="notation">(</span></a><span class="id" title="var">st</span> <span class="id" title="definition">X</span><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0f31f5c1c6b6a21a3a187247222bc9e<sub>4</sub>"><span class="id" title="notation">)</span></a>) <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Compare_dec.html#leb_iff"><span class="id" title="abbreviation">leb_iff</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Compare_dec.html#leb_iff_conv"><span class="id" title="lemma">leb_iff_conv</span></a> <span class="id" title="keyword">in</span> *; <span class="id" title="tactic">intuition</span>; <span class="id" title="tactic">eauto</span>; <span class="id" title="tactic">try</span> <span class="id" title="var">lia</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;(part&nbsp;1)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <a class="idref" href="Hoare2.html#l<sub>4</sub>"><span class="id" title="lemma">l<sub>4</sub></span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">H<sub>0</sub></span>; <span class="id" title="tactic">eauto</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;(part&nbsp;2)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <a class="idref" href="Hoare2.html#l<sub>4</sub>"><span class="id" title="lemma">l<sub>4</sub></span></a>; <span class="id" title="tactic">eauto</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;strong&nbsp;enough&nbsp;to&nbsp;imply&nbsp;conclusion<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;direction)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">H<sub>0</sub></span>. <span class="id" title="tactic">constructor</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;strong&nbsp;enough&nbsp;to&nbsp;imply&nbsp;conclusion<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(&lt;-&nbsp;direction)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> (<span class="id" title="var">st</span> <span class="id" title="definition">X</span>) <span class="id" title="keyword">as</span> [| [| <span class="id" title="var">n</span>] ]. <span class="comment">(*&nbsp;by&nbsp;H<sub>1</sub>&nbsp;X&nbsp;can&nbsp;only&nbsp;be&nbsp;0&nbsp;or&nbsp;1&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;0&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;1&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">H</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;2&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">lia</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a id="lab129"></a><h3 class="section">Square Roots</h3>

</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="sqrt_dec" class="idref" href="#sqrt_dec"><span class="id" title="definition">sqrt_dec</span></a> (<a id="m:89" class="idref" href="#m:89"><span class="id" title="binder">m</span></a>:<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> 0<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a>0 <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> 0<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> <span class="id" title="notation">((</span><span class="id" title="definition">Z</span><span class="id" title="notation">+</span>1<span class="id" title="notation">)</span><span class="id" title="notation">×</span><span class="id" title="notation">(</span><span class="id" title="definition">Z</span><span class="id" title="notation">+</span>1<span class="id" title="notation">)</span> <span class="id" title="notation">≤</span> <span class="id" title="definition">X</span><span class="id" title="notation">)</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a><a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)*(</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a>1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)*(</span></a><span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a>1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a><a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a><a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Z</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a><a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a><a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">~(</span></a><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)*(</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a><a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare2.html#m:89"><span class="id" title="variable">m</span></a><a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a>1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)*(</span></a><span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a>1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="sqrt_correct" class="idref" href="#sqrt_correct"><span class="id" title="lemma">sqrt_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="m:90" class="idref" href="#m:90"><span class="id" title="binder">m</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#sqrt_dec"><span class="id" title="definition">sqrt_dec</span></a> <a class="idref" href="Hoare2.html#m:90"><span class="id" title="variable">m</span></a>).<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="var">verify</span>. <span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a id="lab130"></a><h3 class="section">Squaring</h3>

<div class="paragraph"> </div>

 Again, there are several ways of annotating the squaring program.
    The simplest variant we've found, <span class="inlinecode"><span class="id" title="var">square_simpler_dec</span></span>, is given
    last. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="square_dec" class="idref" href="#square_dec"><span class="id" title="definition">square_dec</span></a> (<a id="m:91" class="idref" href="#m:91"><span class="id" title="binder">m</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> 0<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> <span class="id" title="notation">¬</span><span class="id" title="notation">(</span><span class="id" title="definition">Y</span> <span class="id" title="notation">=</span> 0<span class="id" title="notation">)</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;&gt;'_x"><span class="id" title="notation">≠</span></a> 0 <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">(</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Z</span> <span class="id" title="notation">+</span> <span class="id" title="definition">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Y</span> <span class="id" title="notation">-</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0 <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare2.html#m:91"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="square_dec_correct" class="idref" href="#square_dec_correct"><span class="id" title="lemma">square_dec_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="m:92" class="idref" href="#m:92"><span class="id" title="binder">m</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#square_dec"><span class="id" title="definition">square_dec</span></a> <a class="idref" href="Hoare2.html#m:92"><span class="id" title="variable">m</span></a>).<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="var">verify</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> (<span class="id" title="var">st</span> <span class="id" title="definition">Y</span>) <span class="id" title="keyword">as</span> [| <span class="id" title="var">y'</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="var">exfalso</span>. <span class="id" title="tactic">auto</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">simpl</span>. <span class="id" title="tactic">rewrite</span> &lt;- <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Minus.html#minus_n_O"><span class="id" title="lemma">minus_n_O</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">assert</span> (<span class="id" title="var">G</span> : <span class="id" title="keyword">∀</span> <a id="n:95" class="idref" href="#n:95"><span class="id" title="binder">n</span></a> <a id="m:96" class="idref" href="#m:96"><span class="id" title="binder">m</span></a>, <a class="idref" href="Hoare2.html#n:93"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">×</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> <a class="idref" href="Hoare2.html#m:94"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:93"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare2.html#n:93"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare2.html#m:94"><span class="id" title="variable">m</span></a>). {<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">clear</span>. <span class="id" title="tactic">intros</span>. <span class="id" title="tactic">induction</span> <span class="id" title="var">n</span>. <span class="id" title="tactic">reflexivity</span>. <span class="id" title="tactic">simpl</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <span class="id" title="var">IHn</span>. <span class="id" title="var">lia</span>. }<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> &lt;- <span class="id" title="var">H</span>. <span class="id" title="tactic">rewrite</span> <span class="id" title="var">G</span>. <span class="id" title="var">lia</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="square_dec'" class="idref" href="#square_dec'"><span class="id" title="definition">square_dec'</span></a> (<a id="n:97" class="idref" href="#n:97"><span class="id" title="binder">n</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> 0<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0 <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> <span class="id" title="notation">¬</span><span class="id" title="notation">(</span><span class="id" title="definition">Y</span> <span class="id" title="notation">=</span> 0<span class="id" title="notation">)</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a>  <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;&gt;'_x"><span class="id" title="notation">≠</span></a> 0 <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Z</span> <span class="id" title="notation">+</span> <span class="id" title="definition">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)</span></a><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Y</span> <span class="id" title="notation">-</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0 <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare2.html#n:97"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="square_dec'_correct" class="idref" href="#square_dec'_correct"><span class="id" title="lemma">square_dec'_correct</span></a> : <span class="id" title="keyword">∀</span> (<a id="n:98" class="idref" href="#n:98"><span class="id" title="binder">n</span></a>:<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>),<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#square_dec'"><span class="id" title="definition">square_dec'</span></a> <a class="idref" href="Hoare2.html#n:98"><span class="id" title="variable">n</span></a>).<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="var">verify</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;invariant&nbsp;holds&nbsp;initially,&nbsp;proven&nbsp;by&nbsp;verify&nbsp;&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;*)</span> <span class="id" title="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Mult.html#mult_minus_distr_l"><span class="id" title="abbreviation">mult_minus_distr_l</span></a>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span> <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Mult.html#mult_minus_distr_l"><span class="id" title="abbreviation">mult_minus_distr_l</span></a>. <span class="id" title="tactic">rewrite</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Mult.html#mult_1_r"><span class="id" title="abbreviation">mult_1_r</span></a>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">assert</span> (<span class="id" title="var">G</span> : <span class="id" title="keyword">∀</span> <a id="n:102" class="idref" href="#n:102"><span class="id" title="binder">n</span></a> <a id="m:103" class="idref" href="#m:103"><span class="id" title="binder">m</span></a> <a id="p:104" class="idref" href="#p:104"><span class="id" title="binder">p</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#m:100"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#n:99"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare2.html#p:101"><span class="id" title="variable">p</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare2.html#m:100"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare2.html#n:99"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#m:100"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#p:101"><span class="id" title="variable">p</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:99"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare2.html#m:100"><span class="id" title="variable">m</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare2.html#p:101"><span class="id" title="variable">p</span></a>).<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span>. <span class="id" title="var">lia</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <span class="id" title="var">G</span>. <span class="id" title="tactic">reflexivity</span>. <span class="id" title="tactic">apply</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Mult.html#mult_le_compat_l"><span class="id" title="lemma">mult_le_compat_l</span></a>. <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> (<span class="id" title="var">st</span> <span class="id" title="definition">Y</span>).<br/>
&nbsp;&nbsp;- <span class="id" title="var">exfalso</span>. <span class="id" title="tactic">auto</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="var">lia</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;invariant&nbsp;+&nbsp;negation&nbsp;of&nbsp;guard&nbsp;imply<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;desired&nbsp;postcondition&nbsp;proven&nbsp;by&nbsp;<span class="inlinecode"><span class="id" title="var">verify</span></span>&nbsp;*)</span><br/>
<span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="square_simpler_dec" class="idref" href="#square_simpler_dec"><span class="id" title="definition">square_simpler_dec</span></a> (<a id="m:105" class="idref" href="#m:105"><span class="id" title="binder">m</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> 0 <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 0<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> 0<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> 0 <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> 0<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> <span class="id" title="notation">¬</span><span class="id" title="notation">(</span><span class="id" title="definition">Y</span> <span class="id" title="notation">=</span> <span class="id" title="definition">X</span><span class="id" title="notation">)</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;&gt;'_x"><span class="id" title="notation">≠</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)*</span></a><a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Z</span> <span class="id" title="notation">+</span> <span class="id" title="definition">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1<a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)*</span></a><a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Y</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a><a class="idref" href="Hoare2.html#m:105"><span class="id" title="variable">m</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="square_simpler_dec_correct" class="idref" href="#square_simpler_dec_correct"><span class="id" title="lemma">square_simpler_dec_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="m:106" class="idref" href="#m:106"><span class="id" title="binder">m</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#square_simpler_dec"><span class="id" title="definition">square_simpler_dec</span></a> <a class="idref" href="Hoare2.html#m:106"><span class="id" title="variable">m</span></a>).<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="var">verify</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a id="lab131"></a><h3 class="section">Power Series</h3>

</div>
<div class="code">

<span class="id" title="keyword">Fixpoint</span> <a id="pow2" class="idref" href="#pow2"><span class="id" title="definition">pow2</span></a> <a id="n:107" class="idref" href="#n:107"><span class="id" title="binder">n</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <a class="idref" href="Hoare2.html#n:107"><span class="id" title="variable">n</span></a> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| 0 ⇒ 1<br/>
&nbsp;&nbsp;| <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> <span class="id" title="var">n'</span> ⇒ 2 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">×</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#pow2:108"><span class="id" title="definition">pow2</span></a> <span class="id" title="var">n'</span><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="dpow2_down" class="idref" href="#dpow2_down"><span class="id" title="definition">dpow2_down</span></a> (<a id="n:110" class="idref" href="#n:110"><span class="id" title="binder">n</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare2.html#c00c27417ee45ebadf9f604729ad35ca"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> 1 <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (0 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 1)<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)-</span></a>1 <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> 1 <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> 0 <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> 0<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> 1 <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (0 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 1)<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)-</span></a>1 <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> 1 <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> 1<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1)<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)-</span></a>1 <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> 1 <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> 1<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1)<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)-</span></a>1 <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">while</span></a> <span class="id" title="notation">¬</span><span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">=</span> <a class="idref" href="Hoare2.html#n:110"><span class="id" title="variable">n</span></a><span class="id" title="notation">)</span> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">do</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1)<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)-</span></a>1 <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;&gt;'_x"><span class="id" title="notation">≠</span></a> <a class="idref" href="Hoare2.html#n:110"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 2 <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 2)<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)-</span></a>1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> 2 <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1) <a class="idref" href="Hoare2.html#28f0157bba7bd3bf8c17b67532ba84f<sub>8</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> 2 <span class="id" title="notation">×</span> <span class="id" title="definition">Z</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 2)<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)-</span></a>1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1) <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Y</span> <span class="id" title="notation">+</span> <span class="id" title="definition">Z</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 2)<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)-</span></a>1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1) <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="Hoare2.html#171c4c95468da881f236e87b2dcc4ffa"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1)<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)-</span></a>1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare2.html#6fc777e17570559fe34310ebff6e74b<sub>3</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">(</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> 1)<a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">)-</span></a>1 <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#n:110"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare2.html#88a349ad7000af9e3380552dd1d95d<sub>34</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<a class="idref" href="Hoare2.html#n:110"><span class="id" title="variable">n</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a>1) <a class="idref" href="Hoare.html#::assertion_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1 <a class="idref" href="Hoare2.html#d9c679d5e5db96e17592c387975218ee"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Lemma</span> <a id="pow2_plus_1" class="idref" href="#pow2_plus_1"><span class="id" title="lemma">pow2_plus_1</span></a> : <span class="id" title="keyword">∀</span> <a id="n:111" class="idref" href="#n:111"><span class="id" title="binder">n</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<a class="idref" href="Hoare2.html#n:111"><span class="id" title="variable">n</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a>1) <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> <a class="idref" href="Hoare2.html#n:111"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> <a class="idref" href="Hoare2.html#n:111"><span class="id" title="variable">n</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">induction</span> <span class="id" title="var">n</span>; <span class="id" title="tactic">simpl</span>. <span class="id" title="tactic">reflexivity</span>. <span class="id" title="var">lia</span>. <span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Lemma</span> <a id="pow2_le_1" class="idref" href="#pow2_le_1"><span class="id" title="lemma">pow2_le_1</span></a> : <span class="id" title="keyword">∀</span> <a id="n:112" class="idref" href="#n:112"><span class="id" title="binder">n</span></a>, <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> <a class="idref" href="Hoare2.html#n:112"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#73030c22bc0b1fa771c65aa5414c65f<sub>9</sub>"><span class="id" title="notation">≥</span></a> 1.<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">induction</span> <span class="id" title="var">n</span>. <span class="id" title="tactic">simpl</span>. <span class="id" title="tactic">constructor</span>. <span class="id" title="tactic">simpl</span>. <span class="id" title="var">lia</span>. <span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="dpow2_down_correct" class="idref" href="#dpow2_down_correct"><span class="id" title="lemma">dpow2_down_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="n:113" class="idref" href="#n:113"><span class="id" title="binder">n</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#dpow2_down"><span class="id" title="definition">dpow2_down</span></a> <a class="idref" href="Hoare2.html#n:113"><span class="id" title="variable">n</span></a>).<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">m</span>. <span class="id" title="var">verify</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;1&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <a class="idref" href="Hoare2.html#pow2_plus_1"><span class="id" title="lemma">pow2_plus_1</span></a>. <span class="id" title="tactic">rewrite</span> &lt;- <span class="id" title="var">H<sub>0</sub></span>. <span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;2&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> → <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.add_0_r"><span class="id" title="lemma">add_0_r</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> &lt;- <a class="idref" href="Hoare2.html#pow2_plus_1"><span class="id" title="lemma">pow2_plus_1</span></a>. <span class="id" title="var">remember</span> (<span class="id" title="var">st</span> <span class="id" title="definition">X</span>) <span class="id" title="keyword">as</span> <span class="id" title="var">x</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">replace</span> (<a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="var">x</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 1) <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="var">x</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 1))<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">with</span> (<a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="var">x</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 1) <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare2.html#pow2"><span class="id" title="definition">pow2</span></a> (<span class="id" title="var">x</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 1) <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> 1) <span class="id" title="tactic">by</span> <span class="id" title="var">lia</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> &lt;- <a class="idref" href="Hoare2.html#pow2_plus_1"><span class="id" title="lemma">pow2_plus_1</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">replace</span> (<span class="id" title="var">x</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 1 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 1) <span class="id" title="keyword">with</span> (<span class="id" title="var">x</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 2) <span class="id" title="tactic">by</span> <span class="id" title="var">lia</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;3&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> → <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.add_0_r"><span class="id" title="lemma">add_0_r</span></a>. <span class="id" title="tactic">rewrite</span> &lt;- <a class="idref" href="Hoare2.html#pow2_plus_1"><span class="id" title="lemma">pow2_plus_1</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;4&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">replace</span> (<span class="id" title="var">st</span> <span class="id" title="definition">X</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 1 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 1) <span class="id" title="keyword">with</span> (<span class="id" title="var">st</span> <span class="id" title="definition">X</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> 2) <span class="id" title="tactic">by</span> <span class="id" title="var">lia</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">reflexivity</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a id="lab132"></a><h2 class="section">Further Exercises</h2>

<div class="paragraph"> </div>

<a id="lab133"></a><h4 class="section">Exercise: 3 stars, advanced (slow_assignment_dec)</h4>
 Transform the informal decorated program your wrote for
    <span class="inlinecode"><span class="id" title="var">slow_assignment</span></span> into a formal decorated program.  If all goes
    well, the only change you will need to make is to move semicolons,
    which go after the postcondition of an assignment in a formal
    decorated program.  For example,

<div class="paragraph"> </div>

<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ 0 = 0 <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">Y</span> := 0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Y</span> = 0 <span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
<span class="id" title="var">becomes</span><br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ 0 = 0 <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">Y</span> := 0<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">m</span> ∧ <span class="id" title="var">Y</span> = 0 <span style='letter-spacing:-.4em;'>}</span>} ;
</span>
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="slow_assignment_dec" class="idref" href="#slow_assignment_dec"><span class="id" title="definition">slow_assignment_dec</span></a> (<a id="m:114" class="idref" href="#m:114"><span class="id" title="binder">m</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a><br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;REPLACE&nbsp;THIS&nbsp;LINE&nbsp;WITH&nbsp;":=&nbsp;_your_definition_&nbsp;."&nbsp;*)</span>. <span class="id" title="var">Admitted</span>.<br/>
</div>

<div class="doc">
Now prove the correctness of your decorated program.  If all goes well,
    you will need only <span class="inlinecode"><span class="id" title="var">verify</span></span>. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="slow_assignment_dec_correct" class="idref" href="#slow_assignment_dec_correct"><span class="id" title="lemma">slow_assignment_dec_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="m:115" class="idref" href="#m:115"><span class="id" title="binder">m</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#slow_assignment_dec"><span class="id" title="axiom">slow_assignment_dec</span></a> <a class="idref" href="Hoare2.html#m:115"><span class="id" title="variable">m</span></a>).<br/>
<span class="id" title="keyword">Proof</span>. <span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" title="keyword">Definition</span> <a id="manual_grade_for_check_defn_of_slow_assignment_dec" class="idref" href="#manual_grade_for_check_defn_of_slow_assignment_dec"><span class="id" title="definition">manual_grade_for_check_defn_of_slow_assignment_dec</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#option"><span class="id" title="inductive">option</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#11c698c8685bb8ab1cf725545c085ac<sub>4</sub>"><span class="id" title="notation">×</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#None"><span class="id" title="constructor">None</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab134"></a><h4 class="section">Exercise: 4 stars, advanced (factorial_dec)</h4>
 The factorial function is defined recursively in the Coq standard
    library in a way that is equivalent to the following:

<div class="paragraph"> </div>

<br/>
<span class="inlinecode"><span class="id" title="keyword">Fixpoint</span> <span class="id" title="var">fact</span> (<span class="id" title="var">n</span> : <span class="id" title="var">nat</span>) : <span class="id" title="var">nat</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <span class="id" title="var">n</span> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| <span class="id" title="var">O</span> ⇒ 1<br/>
&nbsp;&nbsp;| <span class="id" title="var">S</span> <span class="id" title="var">n'</span> ⇒ <span class="id" title="var">n</span> × (<span class="id" title="var">fact</span> <span class="id" title="var">n'</span>)<br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.
</span>     
</div>
<div class="code">

<span class="id" title="keyword">Compute</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Factorial.html#fact"><span class="id" title="definition">fact</span></a> 5. <span class="comment">(*&nbsp;==&gt;&nbsp;120&nbsp;*)</span><br/>
</div>

<div class="doc">
Using your solutions to <span class="inlinecode"><span class="id" title="var">factorial</span></span> and <span class="inlinecode"><span class="id" title="var">slow_assignment_dec</span></span> as a
    guide, write a formal decorated program <span class="inlinecode"><span class="id" title="var">factorial_dec</span></span> that
    implements the factorial function.  Hint: recall the use of <span class="inlinecode"><span class="id" title="var">ap</span></span>
    in assertions to apply a function to an Imp variable.

<div class="paragraph"> </div>

    Then state a theorem named <span class="inlinecode"><span class="id" title="var">factorial_dec_correct</span></span> that says
    <span class="inlinecode"><span class="id" title="var">factorial_dec</span></span> is correct, and prove the theorem.  If all goes
    well, <span class="inlinecode"><span class="id" title="var">verify</span></span> will leave you with just two subgoals, each of
    which requires establishing some mathematical property of <span class="inlinecode"><span class="id" title="var">fact</span></span>,
    rather than proving anything about your program.

<div class="paragraph"> </div>

    Hint: if those two subgoals become tedious to prove, give some
    though to how you could restate your assertions such that the
    mathematical operations are more amenable to manipulation in Coq.
    For example, recall that <span class="inlinecode">1</span> <span class="inlinecode">+</span> <span class="inlinecode">...</span> is easier to work with than
    <span class="inlinecode">...</span> <span class="inlinecode">+</span> <span class="inlinecode">1</span>. 
</div>
<div class="code">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" title="keyword">Definition</span> <a id="manual_grade_for_factorial_dec" class="idref" href="#manual_grade_for_factorial_dec"><span class="id" title="definition">manual_grade_for_factorial_dec</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#option"><span class="id" title="inductive">option</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#11c698c8685bb8ab1cf725545c085ac<sub>4</sub>"><span class="id" title="notation">×</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#None"><span class="id" title="constructor">None</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab135"></a><h4 class="section">Exercise: 2 stars, advanced, optional (fib_eqn)</h4>
 The Fibonacci function is usually written like this:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">Fixpoint</span> <span class="id" title="var">fib</span> <span class="id" title="var">n</span> :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">match</span> <span class="id" title="var">n</span> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| 0 ⇒ 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| 1 ⇒ 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| <span class="id" title="var">_</span> ⇒ <span class="id" title="var">fib</span> (<span class="id" title="var">pred</span> <span class="id" title="var">n</span>) + <span class="id" title="var">fib</span> (<span class="id" title="var">pred</span> (<span class="id" title="var">pred</span> <span class="id" title="var">n</span>))<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span>.
</span>   This doesn't pass Coq's termination checker, but here is a
   slightly clunkier definition that does: 
</div>
<div class="code">

<span class="id" title="keyword">Fixpoint</span> <a id="fib" class="idref" href="#fib"><span class="id" title="definition">fib</span></a> <a id="n:116" class="idref" href="#n:116"><span class="id" title="binder">n</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">match</span> <a class="idref" href="Hoare2.html#n:116"><span class="id" title="variable">n</span></a> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;| 0 ⇒ 1<br/>
&nbsp;&nbsp;| <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> <span class="id" title="var">n'</span> ⇒ <span class="id" title="keyword">match</span> <span class="id" title="var">n'</span> <span class="id" title="keyword">with</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| 0 ⇒ 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> <span class="id" title="var">n''</span> ⇒ <a class="idref" href="Hoare2.html#fib:117"><span class="id" title="definition">fib</span></a> <span class="id" title="var">n'</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare2.html#fib:117"><span class="id" title="definition">fib</span></a> <span class="id" title="var">n''</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span>.<br/>
</div>

<div class="doc">
Prove that <span class="inlinecode"><span class="id" title="var">fib</span></span> satisfies the following equation.  You will need this
    as a lemma in the next exercise. 
</div>
<div class="code">

<span class="id" title="keyword">Lemma</span> <a id="fib_eqn" class="idref" href="#fib_eqn"><span class="id" title="lemma">fib_eqn</span></a> : <span class="id" title="keyword">∀</span> <a id="n:120" class="idref" href="#n:120"><span class="id" title="binder">n</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#n:120"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#::nat_scope:x_'&gt;'_x"><span class="id" title="notation">&gt;</span></a> 0 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#fib"><span class="id" title="definition">fib</span></a> <a class="idref" href="Hoare2.html#n:120"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare2.html#fib"><span class="id" title="definition">fib</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.pred"><span class="id" title="definition">pred</span></a> <a class="idref" href="Hoare2.html#n:120"><span class="id" title="variable">n</span></a>) <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare2.html#fib"><span class="id" title="definition">fib</span></a> (1 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare2.html#n:120"><span class="id" title="variable">n</span></a>).<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab136"></a><h4 class="section">Exercise: 4 stars, advanced, optional (fib)</h4>
 The following Imp program leaves the value of <span class="inlinecode"><span class="id" title="var">fib</span></span> <span class="inlinecode"><span class="id" title="var">n</span></span> in the
    variable <span class="inlinecode"><span class="id" title="var">Y</span></span> when it terminates:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 1 + <span class="id" title="var">n</span>) <span class="id" title="tactic">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">T</span> := <span class="id" title="var">Z</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + <span class="id" title="var">Y</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">T</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 1 + <span class="id" title="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span>
</span>    Fill in the following definition of <span class="inlinecode"><span class="id" title="var">dfib</span></span> and prove that it
    satisfies this specification:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">dfib</span> <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">fib</span> <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    If all goes well, your proof will be very brief.
    Hint: you will need many uses of <span class="inlinecode"><span class="id" title="var">ap</span></span> in your assertions.

</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="T" class="idref" href="#T"><span class="id" title="definition">T</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a> := "T".<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="dfib" class="idref" href="#dfib"><span class="id" title="definition">dfib</span></a> (<a id="n:121" class="idref" href="#n:121"><span class="id" title="binder">n</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare2.html#decorated"><span class="id" title="inductive">decorated</span></a><br/>
<span class="comment">(*&nbsp;REPLACE&nbsp;THIS&nbsp;LINE&nbsp;WITH&nbsp;":=&nbsp;_your_definition_&nbsp;."&nbsp;*)</span>. <span class="id" title="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="dfib_correct" class="idref" href="#dfib_correct"><span class="id" title="lemma">dfib_correct</span></a> : <span class="id" title="keyword">∀</span> <a id="n:122" class="idref" href="#n:122"><span class="id" title="binder">n</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare2.html#dec_correct"><span class="id" title="definition">dec_correct</span></a> (<a class="idref" href="Hoare2.html#dfib"><span class="id" title="axiom">dfib</span></a> <a class="idref" href="Hoare2.html#n:122"><span class="id" title="variable">n</span></a>).<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab137"></a><h4 class="section">Exercise: 5 stars, advanced, optional (improve_dcom)</h4>
 The formal decorated programs defined in this section are intended
    to look as similar as possible to the informal ones defined earlier
    in the chapter.  If we drop this requirement, we can eliminate
    almost all annotations, just requiring final postconditions and
    loop invariants to be provided explicitly.  Do this -- i.e., define a
    new version of dcom with as few annotations as possible and adapt the
    rest of the formal development leading up to the <span class="inlinecode"><span class="id" title="var">verification_correct</span></span>
    theorem. 
</div>
<div class="code">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<font size=-2>&#9744;</font>
</div>

<div class="code">

<span class="comment">(*&nbsp;2021-08-11&nbsp;15:11&nbsp;*)</span><br/>
</div>
</div>

<div id="footer">
<hr/><a href="coqindex.html">Index</a><hr/>This page has been generated by <a href="http://coq.inria.fr/">coqdoc</a>
</div>

</div>

</body>
</html>